# Enforcing TLS mode via Operators

**URL:** <https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949>\
**Category:** Percona Operator for MongoDB\
**Created:** [June 21, 2021, 3:13am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949 "2021-06-21T03:13:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![kylem](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/kylem/32/3748_2.png) [@kylem](https://forums.percona.com/u/kylem)\
**Post date:** [June 21, 2021, 3:13am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/1 "2021-06-21T03:13:58Z")

</div>

Hi there,

I am trying to add `requireTLS` to force all connections to use TLS. It seems that for some reason, there is code in ps-entry.sh which is changing this to preferTLS.

I cannot find any document as to why this is happening, but it seems to be intentional. Is there a reason why this has been done in the operators or is this a bug?

---

<div class="post-metadata">

**Author:** ![wenjian](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@wenjian](https://forums.percona.com/u/wenjian)\
**Post date:** [June 29, 2021, 6:56am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/2 "2021-06-29T06:56:06Z")

</div>

in the line 411 of the ps-entry.sh, I found something about requireTLS, but unfortunately, I cannot set to requireTLS either

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/2X/e/e8366591b2c4f6e960bf0c509e1480baad6c6d41.png)

I have already set the net.tls.mode to requireTLS in cr.yml

```nohighlight
  mongod:
    net:
      port: 27017
      hostPort: 0
      tls:
        mode: requireTLS

```

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [July 12, 2021, 10:14am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/3 "2021-07-12T10:14:44Z")

</div>

Hello @wenjian and @kylem

thank you for submitting this. I will check with our eng team what can be done to set requireTLS.

---

<div class="post-metadata">

**Author:** ![Sergey\_Pronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_pronin/32/14887_2.png) [@Sergey\_Pronin](https://forums.percona.com/u/Sergey_Pronin)\
**Post date:** [July 12, 2021, 10:40am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/4 "2021-07-12T10:40:40Z")

</div>

Seems it is not possible to set requireTLS now through the Operator.  
I have raised an improvement in JIRA: [[K8SPSMDB-515] Allow setting requireTLS mode for MongoDB through the Operator - Percona JIRA](https://jira.percona.com/browse/K8SPSMDB-515)

I don’t have any confirmed ETA of when it is going to be resolved.  
Please let me know if this is a hard blocker for you.

---

<div class="post-metadata">

**Author:** ![kylem](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/kylem/32/3748_2.png) [@kylem](https://forums.percona.com/u/kylem)\
**Post date:** [July 12, 2021, 8:45pm UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/5 "2021-07-12T20:45:04Z")

</div>

Hi @Sergey_Pronin

That’s great, thanks for logging the improvement.

It is one of the blockers for using this Operator for my use case, so I will look at the operator once the feature set is further along.

Thank you

---

<div class="post-metadata">

**Author:** ![wenjian](https://avatars.discourse-cdn.com/v4/letter/w/9de053/32.png) [@wenjian](https://forums.percona.com/u/wenjian)\
**Post date:** [July 13, 2021, 1:37am UTC](https://forums.percona.com/t/enforcing-tls-mode-via-operators/10949/6 "2021-07-13T01:37:05Z")

</div>

same as @kylem , requireTLS is a mandatory security item to be follow.