chore: validate tls-name and auth-config-file in xdr config [KO-606] by sidntrivedi · Pull Request #575 · aerospike/aerospike-kubernetes-operator

sidntrivedi · 2026-08-05T11:37:05Z

Addresses https://aerospike.atlassian.net/browse/KO-606.

Summary

Adds the following validation in Aerospike validating webhook for XDR config:
1. tls-name in xdr section must be the one that is mentioned in the network config
2. connector: true requires auth-mode: none (or unset)
3. connector: true disallows auth-password-file
4. connector: true disallows auth-user
5. auth-user set requires auth-mode ≠ none
6. auth-user and auth-password-file must be set together (both directions)
7. auth-mode in {internal, external, external-insecure} requires auth-user
8. auth-mode: pki requires tls-name to be set

Testing done

Used the following source and destination cluster XDR specs:

Source XDR cluster

apiVersion: asdb.aerospike.com/v1
kind: AerospikeCluster
metadata:
  name: aeroclustersrc
  namespace: aerospike

spec:
  size: 2
  image: aerospike/aerospike-server-enterprise:8.1.2.0

  storage:
    filesystemVolumePolicy:
      cascadeDelete: true
      initMethod: deleteFiles
    volumes:
      - name: workdir
        aerospike:
          path: /opt/aerospike
        source:
          persistentVolume:
            storageClass: ssd
            volumeMode: Filesystem
            size: 1Gi
      - name: ns
        aerospike:
          path: /opt/aerospike/data
        source:
          persistentVolume:
            storageClass: ssd
            volumeMode: Filesystem
            size: 3Gi
      - name: aerospike-config-secret
        source:
          secret:
            secretName: aerospike-secret
        aerospike:
          path: /etc/aerospike/secret

  podSpec:
    multiPodPerHost: true

  aerospikeAccessControl:
    users:
      - name: admin
        secretName: auth-secret
        roles:
          - sys-admin
          - user-admin
          - read-write

  operatorClientCert:
    secretCertSource:
      secretName: aerospike-secret
      caCertsFilename: cacert.pem
      clientCertFilename: svc_cluster_chain.pem
      clientKeyFilename: svc_key.pem

  aerospikeConfig:
    service:
      feature-key-file: /etc/aerospike/secret/features.conf
      cgroup-mem-tracking: true

    security: {}

    network:
      service:
        tls-name: aerospike-a-0.test-runner
        tls-authenticate-client: any
        tls-port: 4333
      fabric:
        tls-name: aerospike-a-0.test-runner
        tls-port: 3011
      heartbeat:
        tls-name: aerospike-a-0.test-runner
        tls-port: 3012
      tls:
        - name: aerospike-a-0.test-runner
          cert-file: /etc/aerospike/secret/svc_cluster_chain.pem
          key-file: /etc/aerospike/secret/svc_key.pem
          ca-file: /etc/aerospike/secret/cacert.pem

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000
          tls-name: aerospike-a-0.test-runner
          connector: true
          auth-user: admin
          auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: internal
          namespaces:
            - name: test

    namespaces:
      - name: test
        replication-factor: 2
        storage-engine:
          type: device
          files:
            - /opt/aerospike/data/test.dat
          filesize: 2000000000

Destination XDR cluster

apiVersion: asdb.aerospike.com/v1
kind: AerospikeCluster
metadata:
  name: aeroclusterdst
  namespace: aerospike

spec:
  size: 2
  image: aerospike/aerospike-server-enterprise:8.1.2.0

  storage:
    filesystemVolumePolicy:
      cascadeDelete: true
      initMethod: deleteFiles
    volumes:
      - name: workdir
        aerospike:
          path: /opt/aerospike
        source:
          persistentVolume:
            storageClass: ssd
            volumeMode: Filesystem
            size: 1Gi
      - name: ns
        aerospike:
          path: /opt/aerospike/data
        source:
          persistentVolume:
            storageClass: ssd
            volumeMode: Filesystem
            size: 3Gi
      - name: aerospike-config-secret
        source:
          secret:
            secretName: aerospike-secret
        aerospike:
          path: /etc/aerospike/secret

  podSpec:
    multiPodPerHost: true

  aerospikeAccessControl:
    users:
      - name: admin
        secretName: auth-secret
        roles:
          - sys-admin
          - user-admin
          - read-write
  aerospikeNetworkPolicy:
    access: "pod"

  operatorClientCert:
    secretCertSource:
      secretName: aerospike-secret
      caCertsFilename: cacert.pem
      clientCertFilename: svc_cluster_chain.pem
      clientKeyFilename: svc_key.pem

  aerospikeConfig:
    service:
      feature-key-file: /etc/aerospike/secret/features.conf
      cgroup-mem-tracking: true
    security: {}
    network:
      service:
        tls-name: aerospike-a-0.test-runner
        tls-authenticate-client: any
        tls-port: 4333
      fabric:
        tls-name: aerospike-a-0.test-runner
        tls-port: 3011
      heartbeat:
        tls-name: aerospike-a-0.test-runner
        tls-port: 3012
      tls:
        - name: aerospike-a-0.test-runner
          cert-file: /etc/aerospike/secret/svc_cluster_chain.pem
          key-file: /etc/aerospike/secret/svc_key.pem
          ca-file: /etc/aerospike/secret/cacert.pem

    namespaces:
      - name: test
        replication-factor: 2
        storage-engine:
          type: device
          files:
            - /opt/aerospike/data/test.dat
          filesize: 2000000000

Validation Testing

1. tls-name in xdr section must be the one that is mentioned in the network config

Changed the tls-name in xdr spec to a wrong value instead of aerospike-a-0.test-runner which is mentioned in the network.tls section.

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000
          tls-name: wrong-tls-name
          connector: true
          auth-user: admin
          auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: internal
          namespaces:
            - name: test

Before the validation added in webhook, server pod failed with the following error:

Aug 05 2026 09:41:03 GMT: INFO (tls): (tls_ee.c:1383) registered heartbeat for change in context aerospike-a-0.test-runner
Aug 05 2026 09:41:03 GMT: INFO (tls): (tls_ee.c:1383) registered fabric for change in context aerospike-a-0.test-runner
Aug 05 2026 09:41:03 GMT: WARNING (config): (cfg.c:5922) invalid tls-name in TLS configuration: wrong-tls-name
Aug 05 2026 09:41:03 GMT: CRITICAL (xdr): (dc.c:591) DC dc1 failed to set up TLS
Aug 05 2026 09:41:03 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 05 2026 09:41:03 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

After the validation added in webhook:

❯ k apply -f xdr_src_cluster_cr.yaml -n aerospike
Error from server (Forbidden): error when creating "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1].tls-name 'wrong-tls-name' must refer the TLS configuration defined in network.tls

2. connector: true requires auth-mode: none (or unset)

XDR Config:

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000 aerospike-a-0.test-runner
          tls-name: aerospike-a-0.test-runner
          connector: true
          auth-user: admin
          auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: external
          namespaces:
            - name: test

Server failure:

Aug 07 2026 09:51:25 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf)
Aug 07 2026 09:51:25 GMT: WARNING (xdr): (dc.c:3296) DC dc1 can't set 'auth-mode' if 'connector' is 'true'
Aug 07 2026 09:51:25 GMT: CRITICAL (xdr): (dc.c:454) DC dc1 has invalid authentication config
Aug 07 2026 09:51:25 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 07 2026 09:51:25 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

Webhook failure:

for: "xdr_src_cluster_cr.yaml": error when patching "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: auth-mode must be 'none' for 'connector' datacenters

3. connector: true disallows auth-password-file

Restore the tls-name to correct value and then applied again to test the validation failure when connector: true and auth-password-file are set together.

Before the validation was added in webhook, the server errored out with:

Aug 05 2026 09:02:07 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf)
Aug 05 2026 09:02:07 GMT: WARNING (xdr): (dc.c:3296) DC dc1 can't set 'auth-mode' if 'connector' is 'true'
Aug 05 2026 09:02:07 GMT: CRITICAL (xdr): (dc.c:454) DC dc1 has invalid authentication config
Aug 05 2026 09:02:07 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 05 2026 09:02:07 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

After the fix, validation on webhook layer itself:

❯ k apply -f xdr_src_cluster_cr.yaml -n aerospike
Error from server (Forbidden): error when creating "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: auth-password-file is not allowed for 'connector' datacenters

4. connector: true disallows auth-user

Doesn't give direct error but from the docs, since auth-method is not supported with connector: true, therefore auth-user is also not allowed. Ref: https://aerospike.com/docs/database/reference/config#xdr__auth-user

5. auth-user set requires auth-mode ≠ none

XDR config:

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000 aerospike-a-0.test-runner
          tls-name: aerospike-a-0.test-runner
          # connector: true
          auth-user: admin
          auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: none
          namespaces:
            - name: test

Server failure:

Aug 07 2026 08:54:16 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf)
Aug 07 2026 08:54:16 GMT: WARNING (xdr): (dc.c:3321) DC dc1 has 'auth-user' but 'auth-mode' is 'none'
Aug 07 2026 08:54:16 GMT: CRITICAL (xdr): (dc.c:454) DC dc1 has invalid authentication config
Aug 07 2026 08:54:16 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 07 2026 08:54:16 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

Webhook failure:

for: "xdr_src_cluster_cr.yaml": error when patching "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: auth-mode must not be 'none' when auth-user is set

6. auth-user and auth-password-file must be set together (both directions)

XDR config:

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000 aerospike-a-0.test-runner
          tls-name: aerospike-a-0.test-runner
          # connector: true
          auth-user: admin
          # auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: internal
          namespaces:
            - name: test

Server failure:

Aug 07 2026 08:57:35 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf)
Aug 07 2026 08:57:35 GMT: WARNING (xdr): (dc.c:3308) DC dc1 has 'auth-user' but no 'auth-password-file'
Aug 07 2026 08:57:35 GMT: CRITICAL (xdr): (dc.c:454) DC dc1 has invalid authentication config
Aug 07 2026 08:57:35 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 07 2026 08:57:35 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

Webhook failure:

for: "xdr_src_cluster_cr.yaml": error when patching "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: auth-user is set but auth-password-file is missing

7. auth-mode in {internal, external, external-insecure} requires auth-user

Server failure:

Aug 07 2026 09:02:04 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf)
Aug 07 2026 09:02:04 GMT: WARNING (xdr): (dc.c:3302) DC dc1 has 'auth-mode' which requires 'auth-user'
Aug 07 2026 09:02:04 GMT: CRITICAL (xdr): (dc.c:454) DC dc1 has invalid authentication config
Aug 07 2026 09:02:04 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d
Aug 07 2026 09:02:04 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

Webhook failure:

for: "xdr_src_cluster_cr.yaml": error when patching "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: auth-user is required when auth-mode is 'internal'

8. auth-mode: pki requires tls-name to be set

XDR config:

    xdr:
      dcs:
        - name: dc1
          node-address-ports:
            - aeroclusterdst-0-0 3000 aerospike-a-0.test-runner
          # tls-name: aerospike-a-0.test-runner
          # connector: true
          # auth-user: admin
          # auth-password-file: /etc/aerospike/secret/password_DC1.txt
          auth-mode: pki
          namespaces:
            - name: test

Server failure:

Aug 07 2026 09:08:21 GMT: INFO (config): (features_ee.c:277) loaded feature key #261050504 (/etc/aerospike/secret/features.conf) 
Aug 07 2026 09:08:21 GMT: CRITICAL (xdr): (dc.c:477) DC dc1 unexpected TLS name for node aeroclusterdst-0-0:3000:aerospike-a-0.test-runner 
Aug 07 2026 09:08:21 GMT: WARNING (as): (signal.c:238) SIGINT received, aborting Aerospike Enterprise Edition build 8.1.2.0 os ubuntu24.04 arch x86_64 sha e3ba1cb ee-sha f35fe2d 
Aug 07 2026 09:08:21 GMT: WARNING (as): (signal.c:206) startup was not complete, exiting immediately

Webhook failure:

for: "xdr_src_cluster_cr.yaml": error when patching "xdr_src_cluster_cr.yaml": admission webhook "vaerospikecluster.kb.io" denied the request: xdr.dcs[dc1]: tls-name is required when auth-mode is 'pki'

sidntrivedi added the Work In Progress label Aug 5, 2026

sidntrivedi force-pushed the chore/KO-606-xdr-validation branch 2 times, most recently from db01acb to 40667ce Compare August 6, 2026 07:35

sidntrivedi marked this pull request as ready for review August 6, 2026 07:57

sidntrivedi requested review from abhishekdwivedi3060, shubhamyelikar99 and tanmayja as code owners August 6, 2026 07:57

sidntrivedi removed the Work In Progress label Aug 6, 2026

sidntrivedi force-pushed the chore/KO-606-xdr-validation branch from 0381240 to a1b02d4 Compare August 7, 2026 08:30

chore: validate tls-name and auth configurations in xdr config [KO-606]

8f2dc89

sidntrivedi force-pushed the chore/KO-606-xdr-validation branch from a1b02d4 to 8f2dc89 Compare August 7, 2026 09:17

Navigation Menu

Uh oh!

chore: validate tls-name and auth-config-file in xdr config [KO-606] - #575

chore: validate tls-name and auth-config-file in xdr config [KO-606]#575
sidntrivedi wants to merge 1 commit into
masterfrom
chore/KO-606-xdr-validation

sidntrivedi commented Aug 5, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

sidntrivedi commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Testing done

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sidntrivedi commented Aug 5, 2026 •

edited

Loading