4 results found

1. Support for EKS Service Account Credentials in MONGODB-AWS

   Support for EKS Service Account Credentials in MONGODB-AWS

   It would be great to be able to authenticate to MongoDB using EKS service accounts.

   Currently, the order in which Drivers MUST search for credentials is:
   Credentials passed through the URI
   Environment variables
   ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
   EC2 endpoint
   (https://pymongo.readthedocs.io/en/stable/examples/authentication.html#mongodb-aws)

   It is possible use the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables injected into the pod by EKS to assume the service account role and get temporary security credentials, which could then be passed to the uri as described in AssumeRole (https://pymongo.readthedocs.io/en/stable/examples/authentication.html#assumerole).

   The boto client for sts provides a assume_role_with_web_identity method that accepts role_arn and web_identity_token as parameter that can be used to obtain temporary credentials.

   Rather than having to add extra boiler plate code to applications, is this something that could be supported natively by the drivers?

   So the order the drivers would search for credentials might then look like the following:
   Credentials passed through the URI
   Environment variables
   ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
   Assume EKS Service acccount role to get temporary credentials if and only if AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE are set
   EC2 endpoint

   Support for EKS Service Account Credentials in MONGODB-AWS

   It would be great to be able to authenticate to MongoDB using EKS service accounts.

   Currently, the order in which Drivers MUST search for credentials is:
   Credentials passed through the URI
   Environment variables
   ECS endpoint if and only if AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is set.
   EC2 endpoint
   (https://pymongo.readthedocs.io/en/stable/examples/authentication.html#mongodb-aws)

   It is possible use the AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables injected into the pod by EKS to assume the service account role and get temporary security credentials, which could then be passed to the uri as described in AssumeRole (https://pymongo.readthedocs.io/en/stable/examples/authentication.html#assumerole).

   The boto client… more

   30 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   2 comments  ·  Python  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   started  ·  AdminRachelle (Admin, MongoDB) responded

   This work is currently in progress-  you can track your programming language of choice here https://jira.mongodb.org/browse/DRIVERS-1746

2. Normalize maximum time in MS parameter name, maxTimeMS vs max_time_ms

   Currently, some operations such as aggregate() or count_documents use maxTimeMS as parameter name, but others such as the find(), use max_time_ms, so unless you memorize which method uses which nomenclature, you have to check the docs every time.
   This is specially confusing since, for example, find_one() uses max_time_ms but all the find_one_and_...() methods use maxTimeMS.

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Python  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

3. Generic count property in _WriteResult class

   Hi,

   I'm using a MongoDB as a backend for my API and often come to a case where i want to validate whether I updated, inserted or deleted any records. At the moment I use the deletedcount and machtedcount properties in the DeleteResult and UpdateResult object. To provide a more generic way I thought it may makes sense to provide a new property in the generic WriteResult class called affectedrecords or something like that so you can generic react to the result of your database transaction and maybe return a 404 if nothing was updated, deleted or created.
   Let me know what you think and thanks in advance.

   Hi,

   I'm using a MongoDB as a backend for my API and often come to a case where i want to validate whether I updated, inserted or deleted any records. At the moment I use the deletedcount and machtedcount properties in the DeleteResult and UpdateResult object. To provide a more generic way I thought it may makes sense to provide a new property in the generic WriteResult class called affectedrecords or something like that so you can generic react to the result of your database transaction and maybe return a 404 if nothing was updated, deleted or… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Python  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

4. Add non-EJSON as option for json utils

   python and other drivers offer to-json utils. This makes taking a native rich shape complete with datetimes and byte[] and such and easily turning into bson (the best way!) or JSON. The utils offer options to modify the output representations of types but always do so in an EJSON way, namely with $date/$numberDecimal etc. Sometimes a consumer cannot (or will not) accept data in this fashion. I'd like to see a "safePureJSON" option (or similar) for bson.json_utils.dumps() that emits the safe string or number equivalent of the EJSON.
   fld: {$date: "ISOdate"} becomes fld: "ISOdate"
   fld: {$numberDecimal: "99.9"} becomes fld: "99.9" (string, to prevent float parse issues)
   fld: {$numberLong: "1234567890123456"} becomes fld: 1234567890123456

   float and int32 are not a problem.
   Not as much of a issue for $binary because the extra info is probably helpful for the decoding rather than a hindrance.

   python and other drivers offer to-json utils. This makes taking a native rich shape complete with datetimes and byte[] and such and easily turning into bson (the best way!) or JSON. The utils offer options to modify the output representations of types but always do so in an EJSON way, namely with $date/$numberDecimal etc. Sometimes a consumer cannot (or will not) accept data in this fashion. I'd like to see a "safePureJSON" option (or similar) for bson.json_utils.dumps() that emits the safe string or number equivalent of the EJSON.
   fld: {$date: "ISOdate"} becomes fld: "ISOdate"
   fld: {$numberDecimal: "99.9"} becomes fld: "99.9"… more

   1 vote

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Python  ·  Edit…  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close