patch(DPE-9339): MongoDB Encryption At Rest by Gu1nness · Pull Request #258 · canonical/mongo-single-kernel-library

Gu1nness · 2026-03-19T16:33:29Z

🏷️ Type of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation update
Tooling and CI
Dependencies upgrade or change
Chores / refactoring

📝 Description

This is the implementation of MongoDB encryption at rest.
It uses Vault (Vault-k8s on kubernetes) as a backend to store the encryption keys.
It uses a config option to enable encryption at rest at boot time.
It uses an action to rotate the master key.

🧪 Manual testing steps

🌞 Sunny test

1. juju deploy <my-app> --config enable-encryption-at-rest=true
2. follow [the tutorial](https://canonical-vault-charms.readthedocs-hosted.com/en/latest/tutorial/getting_started_k8s/) to deploy and unseal vault/vault-k8s
3. juju integrate <my-app>:vault-kv vault:vault-kv
4. Profit (you can check the startup options of mongodb to ensure that it contains enableEncryption: True)
5. juju run <my-app>/<a-unit> rotate-encryption-master-key
6. Check in log file that it contains `Rotated master encryption key`.

🌧️ Rainy test:

1. juju deploy <my-app> --config enable-encryption-at-rest=false (the default)
2. follow [the tutorial](https://canonical-vault-charms.readthedocs-hosted.com/en/latest/tutorial/getting_started_k8s/) to deploy and unseal vault/vault-k8s
3. juju integrate <my-app>:vault-kv vault:vault-kv
4. It goes to blocked BUT does not prevent the charm from operating.

🔬 Automated testing steps

Positive checks that:

Deployment goes to blocked until integrated with vault
Integration restarts with correct options
Rotation works
Removing the relation goes to blocked.

Negative checks that:

Deploying with encryption disabled and integrating with vault goes to blocked
Trying to rotate master key in that scenario fails.

✅ Checklist

My code follows the code style of this project.
I have added or updated any relevant documentation.
I have read the CONTRIBUTING document.
I have added tests to cover my changes.
All new and existing tests passed.

…ment-encryption-at-rest-according-to-approved-design

patriciareinoso

extremely quick pass over the code

single_kernel_mongo/config/statuses.py

single_kernel_mongo/workload/vault_agent_workload.py

tests/integration/helpers/vault.py

…ment-encryption-at-rest-according-to-approved-design

single_kernel_mongo/config/statuses.py

single_kernel_mongo/events/lifecycle.py

single_kernel_mongo/managers/vault.py

single_kernel_mongo/events/lifecycle.py

single_kernel_mongo/events/vault.py

single_kernel_mongo/managers/config.py

single_kernel_mongo/state/app_peer_state.py

single_kernel_mongo/state/vault_state.py

single_kernel_mongo/workload/mongodb_workload.py

Co-authored-by: Patricia Reinoso <patricia.reinoso@canonical.com> Signed-off-by: Neha Oudin <17551419+Gu1nness@users.noreply.github.com>

…ment-encryption-at-rest-according-to-approved-design

…ncryption-at-rest-implement-encryption-at-rest-according-to-approved-design

Mehdi-Bendriss

Thanks Neha, Great work! :)
I left a few comments, but my main concern is on upgrades and see how it all behaves if for ex the token expired (we'll need to followup with another PR for an integration test about it)

Mehdi-Bendriss · 2026-04-11T15:09:58Z

single_kernel_mongo/events/vault.py

+        self.relation_name = ExternalRequirerRelations.VAULT.value
+
+        super().__init__(parent=dependent, key=self.relation_name)
+        self.interface = vault_kv.VaultKvRequires(self.charm, self.relation_name, self.charm.name)


nit

Suggested change

self.interface = vault_kv.VaultKvRequires(self.charm, self.relation_name, self.charm.name)

self.kv_interface = vault_kv.VaultKvRequires(self.charm, self.relation_name, self.charm.name)

Mehdi-Bendriss · 2026-04-11T15:26:40Z

single_kernel_mongo/events/vault.py

+            self.manager.set_status(VaultStatuses.INVALID_CONFIG.value, scope="both")
+            return
+
+    def _on_gone_away(self, event: vault_kv.VaultKvGoneAwayEvent) -> None:


I have 2 questions here,

Did we test the flow when the Vault relation is removed and then re-established?

What is the mongodb and vault agent behaviors regarding the expiration of the token?

Mehdi-Bendriss · 2026-04-11T15:27:46Z

single_kernel_mongo/events/vault.py

+            self.manager.set_status(VaultStatuses.VAULT_INTEGRATED.value, scope="both")
+            return
+        self.manager.clear_statuses(scope="both")
+        egress_subnets = self.manager.get_subnets()


probably worth renaming get_subnets to get_egress_subnets for clarity

Mehdi-Bendriss · 2026-04-11T15:28:44Z

single_kernel_mongo/events/vault.py

+            return
+        egress_subnets = self.manager.get_subnets()
+        nonce = self.manager.get_nonce()
+        self.interface.request_credentials(


Could you explain this?

Mehdi-Bendriss · 2026-04-11T15:30:12Z

single_kernel_mongo/managers/config.py

+        return template.render(**new_content)
+
+    @override
+    def set_environment(self):


missing return type hint and in configure_and_restart

Mehdi-Bendriss · 2026-04-11T15:41:29Z

tests/integration/mongodb/encryption/test_encryption_invalid_scenario.py

missing docstrings in tests, and could you add more inline comments to document the flow and expectations?

Mehdi-Bendriss · 2026-04-11T15:42:42Z

tests/integration/helpers/vault.py

missing docstrings in some helpers - and could you add more inline comments to explain some of the flows?

Mehdi-Bendriss · 2026-04-11T15:43:23Z

tests/integration/mongodb/encryption/test_encryption_valid_scenario.py

Missing docstrings and some explanations inline comments here and there

Mehdi-Bendriss · 2026-04-11T15:48:19Z

tests/integration/mongodb/encryption/test_encryption_valid_scenario.py

+
+@pytest.mark.abort_on_fail
+async def test_integration_goes_to_active(
+    ops_test: OpsTest, substrate: Substrate, vault_charm_name: str


can we add continuous writes on all tests from this one on? I'd like to see the write/read side of things and expectations on the data side for every Vault related operation.

Mehdi-Bendriss · 2026-04-11T15:50:25Z

tests/integration/mongodb/encryption/test_encryption_valid_scenario.py

+        app_name,
+        status="blocked",
+        message="Must be integrated with vault to enable encryption at rest.",
+    )


Can we add 2 more tests about the restoring of the relation:

after just a quick time while the token is still alive

after the token expiration time

and assert that the health is restored and data can be read / written

Gu1nness and others added 22 commits March 12, 2026 10:35

fix: Add vault-k8s library

b9c4a3b

feat(DPE-9339): initial version of the code

fa0fcee

chore: add images

22fdfbe

fix: remove invalid comment

7f4f88e

fix: config and relation for test charm

0bbb59d

fix: refresh versions

3ed1c62

test: add unit tests (basic)

984922d

chore: final unit tests

b018ab8

chore: more unit tests

086bb77

feat: basic integration tests

6b40e72

fix: progress on tests

f25bd77

fix: changes raised by IT

b0418cb

fix: bump snap revision

63394ec

fix: tests

b722edb

fix: tests

2e88cb9

fix: refine user usage

1e5e38e

fix: final UX + tests

b0868e7

fix: add doc

927fab7

Merge branch '8/edge' into DPE-9339-mongo-db-encryption-at-rest-imple…

598f3cc

…ment-encryption-at-rest-according-to-approved-design

fix: add status

6b6d752

fix: unit tests

be5d280

fix: unit tests

99f74fa

Gu1nness requested review from Mehdi-Bendriss and patriciareinoso March 20, 2026 08:20

patriciareinoso reviewed Mar 27, 2026

View reviewed changes

Gu1nness added 5 commits April 1, 2026 13:48

Merge branch '8/edge' into DPE-9339-mongo-db-encryption-at-rest-imple…

abcf4d9

…ment-encryption-at-rest-according-to-approved-design

fix: post-review

ed5c7b2

fix: post-review

76ade2c

fix: bump mypy

42ffda6

fix: remove duplicated entry

0b366c6

fix: typing

19fd804

Gu1nness requested a review from patriciareinoso April 1, 2026 12:08

Gu1nness force-pushed the DPE-9339-mongo-db-encryption-at-rest-implement-encryption-at-rest-according-to-approved-design branch from 783989d to 19fd804 Compare April 1, 2026 15:33

patriciareinoso reviewed Apr 2, 2026

View reviewed changes

Gu1nness and others added 5 commits April 2, 2026 12:36

Update single_kernel_mongo/managers/config.py

751c8e1

Co-authored-by: Patricia Reinoso <patricia.reinoso@canonical.com> Signed-off-by: Neha Oudin <17551419+Gu1nness@users.noreply.github.com>

Update single_kernel_mongo/state/vault_state.py

c1f2758

Co-authored-by: Patricia Reinoso <patricia.reinoso@canonical.com> Signed-off-by: Neha Oudin <17551419+Gu1nness@users.noreply.github.com>

Update single_kernel_mongo/state/vault_state.py

7ad315e

Co-authored-by: Patricia Reinoso <patricia.reinoso@canonical.com> Signed-off-by: Neha Oudin <17551419+Gu1nness@users.noreply.github.com>

fix: post-review

e79859d

fix: post-review

5617989

Gu1nness requested a review from patriciareinoso April 2, 2026 12:49

Merge branch '8/edge' into DPE-9339-mongo-db-encryption-at-rest-imple…

7fbd89d

…ment-encryption-at-rest-according-to-approved-design

patriciareinoso previously approved these changes Apr 3, 2026

View reviewed changes

Merge remote-tracking branch 'origin/8/edge' into DPE-9339-mongo-db-e…

b677c05

…ncryption-at-rest-implement-encryption-at-rest-according-to-approved-design

Gu1nness dismissed patriciareinoso’s stale review via b677c05 April 8, 2026 07:27

Gu1nness requested a review from patriciareinoso April 8, 2026 14:27

Mehdi-Bendriss reviewed Apr 11, 2026

View reviewed changes

	self.interface = vault_kv.VaultKvRequires(self.charm, self.relation_name, self.charm.name)
	self.kv_interface = vault_kv.VaultKvRequires(self.charm, self.relation_name, self.charm.name)

Conversation

Gu1nness commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏷️ Type of changes

📝 Description

🧪 Manual testing steps

🔬 Automated testing steps

✅ Checklist

Uh oh!

patriciareinoso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Mehdi-Bendriss left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Gu1nness commented Mar 19, 2026 •

edited

Loading