# \[solved\] Expose mongos with TLS

**URL:** <https://forums.percona.com/t/solved-expose-mongos-with-tls/22084>\
**Category:** Percona Operator for MongoDB\
**Tags:** psmdb-operator\
**Created:** [May 16, 2023, 2:30pm UTC](https://forums.percona.com/t/solved-expose-mongos-with-tls/22084 "2023-05-16T14:30:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rdxmbr](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rdxmbr](https://forums.percona.com/u/rdxmbr)\
**Post date:** [May 16, 2023, 2:30pm UTC](https://forums.percona.com/t/solved-expose-mongos-with-tls/22084/1 "2023-05-16T14:30:43Z")

</div>

Hello,

I am just trying to expose the mongos with TLS. For that, I’ve added `preferTLS` to all the configs (see `cr.yaml` below).

Then I created a port-forwarding to the `my-cluster-name-mongos`-service with ClusterIP.

But this endpoint can only be connected without TLS.

```auto
Cannot connect to the MongoDB at 127.0.0.1:32791.

Error:
TLS tunnel failure: Network is unreachable or TLS connection rejected by server. Reason: network error while attempting to run command 'isMaster' on host '127.0.0.1:32791' 

```

When connecting without TLS, everything is working fine.

Here is my `cr.yaml`

```auto
apiVersion: psmdb.percona.com/v1
kind: PerconaServerMongoDB
metadata:
  name: my-cluster-name
  finalizers:
    - delete-psmdb-pods-in-order
    - delete-psmdb-pvc
spec:
# platform: kubernetes
# clusterServiceDNSSuffix: percona.k08.reddoxx.com
    # clusterServiceDNSMode: "External"
# pause: true
# unmanaged: false
  crVersion: 1.15.0
  image: percona/percona-server-mongodb:6.0.4-3
  imagePullPolicy: Always
# tls:
# # 90 days in hours
# certValidityDuration: 2160h
# imagePullSecrets:
# - name: private-registry-credentials
# initImage: perconalab/percona-server-mongodb-operator:main
# initContainerSecurityContext: {}
  allowUnsafeConfigurations: false
  updateStrategy: SmartUpdate
# ignoreAnnotations:
# - service.beta.kubernetes.io/aws-load-balancer-backend-protocol
# ignoreLabels:
# - rack
# multiCluster:
# enabled: true
# DNSSuffix: k08.reddoxx.com
  upgradeOptions:
    versionServiceEndpoint: https://check.percona.com
    apply: disabled
    schedule: "0 2 * * *"
    setFCV: false
  secrets:
    users: my-cluster-name-secrets
    encryptionKey: my-cluster-name-mongodb-encryption-key
      #ssl: rdx-mongodb-cluster-external

# vault: my-cluster-name-vault
  pmm:
    enabled: false
    image: percona/pmm-client:2.35.0
    serverHost: monitoring-service
# mongodParams: --environment=ENVIRONMENT
# mongosParams: --environment=ENVIRONMENT
  replsets:

  - name: rs0
    size: 3
# externalNodes:
# - host: 34.124.76.90
# - host: 34.124.76.91
# port: 27017
# votes: 0
# priority: 0
# - host: 34.124.76.92
# # for more configuration fields refer to https://docs.mongodb.com/manual/reference/configuration-options/
    configuration: |
      net:
        tls:
          mode: preferTLS
# operationProfiling:
# mode: slowOp
# systemLog:
# verbosity: 1
# storage:
# engine: wiredTiger
# wiredTiger:
# engineConfig:
# directoryForIndexes: false
# journalCompressor: snappy
# collectionConfig:
# blockCompressor: snappy
# indexConfig:
# prefixCompression: true
    affinity:
      antiAffinityTopologyKey: "kubernetes.io/hostname"
# advanced:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: kubernetes.io/e2e-az-name
# operator: In
# values:
# - e2e-az1
# - e2e-az2
# tolerations:
# - key: "node.alpha.kubernetes.io/unreachable"
# operator: "Exists"
# effect: "NoExecute"
# tolerationSeconds: 6000
# priorityClassName: high-priority
# annotations:
# iam.amazonaws.com/role: role-arn
# labels:
# rack: rack-22
# nodeSelector:
# disktype: ssd
# storage:
# engine: wiredTiger
# wiredTiger:
# engineConfig:
# cacheSizeRatio: 0.5
# directoryForIndexes: false
# journalCompressor: snappy
# collectionConfig:
# blockCompressor: snappy
# indexConfig:
# prefixCompression: true
# inMemory:
# engineConfig:
# inMemorySizeRatio: 0.5
# livenessProbe:
# failureThreshold: 4
# initialDelaySeconds: 60
# periodSeconds: 30
# timeoutSeconds: 10
# startupDelaySeconds: 7200
# readinessProbe:
# failureThreshold: 8
# initialDelaySeconds: 10
# periodSeconds: 3
# successThreshold: 1
# timeoutSeconds: 2
# runtimeClassName: image-rc
# sidecars:
# - image: busybox
# command: ["/bin/sh"]
# args: ["-c", "while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done"]
# name: rs-sidecar-1
# volumeMounts:
# - mountPath: /volume1
# name: sidecar-volume-claim
# - mountPath: /secret
# name: sidecar-secret
# - mountPath: /configmap
# name: sidecar-config
# sidecarVolumes:
# - name: sidecar-secret
# secret:
# secretName: mysecret
# - name: sidecar-config
# configMap:
# name: myconfigmap
# sidecarPVCs:
# - apiVersion: v1
# kind: PersistentVolumeClaim
# metadata:
# name: sidecar-volume-claim
# spec:
# resources:
# requests:
# storage: 1Gi
# volumeMode: Filesystem
# accessModes:
# - ReadWriteOnce
    podDisruptionBudget:
      maxUnavailable: 1
# minAvailable: 0
    expose:
      enabled: false
      exposeType: LoadBalancer
# loadBalancerSourceRanges:
# - 10.0.0.0/8
# serviceAnnotations:
# loadbalancer.openstack.org/floating-network-id: "XXXXXXXXXXX" 
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
# serviceLabels:
# rack: rack-22
    resources:
      limits:
        cpu: "300m"
        memory: "0.5G"
      requests:
        cpu: "300m"
        memory: "0.5G"
    volumeSpec:
# emptyDir: {}
# hostPath:
# path: /data
# type: Directory
      persistentVolumeClaim:
# annotations:
# volume.beta.kubernetes.io/storage-class: example-hostpath
# labels:
# rack: rack-22
# storageClassName: standard
# accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 3Gi

    nonvoting:
      enabled: false
# podSecurityContext: {}
# containerSecurityContext: {}
      size: 3
# # for more configuration fields refer to https://docs.mongodb.com/manual/reference/configuration-options/
      configuration: |
        net:
          tls:
            mode: preferTLS
# operationProfiling:
# operationProfiling:
# mode: slowOp
# systemLog:
# verbosity: 1
      affinity:
        antiAffinityTopologyKey: "kubernetes.io/hostname"
# advanced:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: kubernetes.io/e2e-az-name
# operator: In
# values:
# - e2e-az1
# - e2e-az2
# tolerations:
# - key: "node.alpha.kubernetes.io/unreachable"
# operator: "Exists"
# effect: "NoExecute"
# tolerationSeconds: 6000
# priorityClassName: high-priority
# annotations:
# iam.amazonaws.com/role: role-arn
# labels:
# rack: rack-22
# nodeSelector:
# disktype: ssd
      podDisruptionBudget:
        maxUnavailable: 1
# minAvailable: 0
      resources:
        limits:
          cpu: "300m"
          memory: "0.5G"
        requests:
          cpu: "300m"
          memory: "0.5G"
      volumeSpec:
# emptyDir: {}
# hostPath:
# path: /data
# type: Directory
        persistentVolumeClaim:
# annotations:
# volume.beta.kubernetes.io/storage-class: example-hostpath
# labels:
# rack: rack-22
# storageClassName: standard
# accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 3Gi
    arbiter:
      enabled: false
      size: 1
      affinity:
        antiAffinityTopologyKey: "kubernetes.io/hostname"
# advanced:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: kubernetes.io/e2e-az-name
# operator: In
# values:
# - e2e-az1
# - e2e-az2
# tolerations:
# - key: "node.alpha.kubernetes.io/unreachable"
# operator: "Exists"
# effect: "NoExecute"
# tolerationSeconds: 6000
# priorityClassName: high-priority
# annotations:
# iam.amazonaws.com/role: role-arn
# labels:
# rack: rack-22
# nodeSelector:
# disktype: ssd

  sharding:
    enabled: true

    configsvrReplSet:
      size: 3
# externalNodes:
# - host: 34.124.76.93
# - host: 34.124.76.94
# port: 27017
# votes: 0
# priority: 0
# - host: 34.124.76.95
# # for more configuration fields refer to https://docs.mongodb.com/manual/reference/configuration-options/
      configuration: |
        net:
          tls:
            mode: preferTLS
# operationProfiling:
# operationProfiling:
# mode: slowOp
# systemLog:
# verbosity: 1
      affinity:
        antiAffinityTopologyKey: "kubernetes.io/hostname"
# advanced:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: kubernetes.io/e2e-az-name
# operator: In
# values:
# - e2e-az1
# - e2e-az2
# tolerations:
# - key: "node.alpha.kubernetes.io/unreachable"
# operator: "Exists"
# effect: "NoExecute"
# tolerationSeconds: 6000
# priorityClassName: high-priority
# annotations:
# iam.amazonaws.com/role: role-arn
# labels:
# rack: rack-22
# nodeSelector:
# disktype: ssd
# livenessProbe:
# failureThreshold: 4
# initialDelaySeconds: 60
# periodSeconds: 30
# timeoutSeconds: 10
# startupDelaySeconds: 7200
# readinessProbe:
# failureThreshold: 3
# initialDelaySeconds: 10
# periodSeconds: 3
# successThreshold: 1
# timeoutSeconds: 2
# runtimeClassName: image-rc
# sidecars:
# - image: busybox
# command: ["/bin/sh"]
# args: ["-c", "while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done"]
# name: rs-sidecar-1
      podDisruptionBudget:
        maxUnavailable: 1
      expose:
        enabled: false
        exposeType: LoadBalancer
# loadBalancerSourceRanges:
# - 10.0.0.0/8
# serviceAnnotations:
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
# serviceLabels:
# rack: rack-22
      resources:
        limits:
          cpu: "300m"
          memory: "0.5G"
        requests:
          cpu: "300m"
          memory: "0.5G"
      volumeSpec:
# emptyDir: {}
# hostPath:
# path: /data
# type: Directory
        persistentVolumeClaim:
# annotations:
# volume.beta.kubernetes.io/storage-class: example-hostpath
# labels:
# rack: rack-22
# storageClassName: standard
# accessModes: ["ReadWriteOnce"]
          resources:
            requests:
              storage: 3Gi

    mongos:
      size: 3
# # for more configuration fields refer to https://docs.mongodb.com/manual/reference/configuration-options/
      configuration: |
        net:
          tls:
            mode: preferTLS
# operationProfiling:
# systemLog:
# verbosity: 1
      affinity:
        antiAffinityTopologyKey: "kubernetes.io/hostname"
# advanced:
# nodeAffinity:
# requiredDuringSchedulingIgnoredDuringExecution:
# nodeSelectorTerms:
# - matchExpressions:
# - key: kubernetes.io/e2e-az-name
# operator: In
# values:
# - e2e-az1
# - e2e-az2
# tolerations:
# - key: "node.alpha.kubernetes.io/unreachable"
# operator: "Exists"
# effect: "NoExecute"
# tolerationSeconds: 6000
# priorityClassName: high-priority
# annotations:
# iam.amazonaws.com/role: role-arn
# labels:
# rack: rack-22
# nodeSelector:
# disktype: ssd
# livenessProbe:
# failureThreshold: 4
# initialDelaySeconds: 60
# periodSeconds: 30
# timeoutSeconds: 10
# startupDelaySeconds: 7200
# readinessProbe:
# failureThreshold: 3
# initialDelaySeconds: 10
# periodSeconds: 3
# successThreshold: 1
# timeoutSeconds: 2
# runtimeClassName: image-rc
# sidecars:
# - image: busybox
# command: ["/bin/sh"]
# args: ["-c", "while true; do echo echo $(date -u) 'test' >> /dev/null; sleep 5;done"]
# name: rs-sidecar-1
      podDisruptionBudget:
        maxUnavailable: 1
      resources:
        limits:
          cpu: "300m"
          memory: "0.5G"
        requests:
          cpu: "300m"
          memory: "0.5G"
      expose:
        exposeType: ClusterIP

# servicePerPod: true
# loadBalancerSourceRanges:
# - 10.0.0.0/8
# serviceAnnotations:
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
# serviceLabels:
# rack: rack-22

# mongod:
# security:
# encryptionKeySecret: "my-cluster-name-mongodb-encryption-key"

  backup:
    enabled: true
    image: perconalab/percona-server-mongodb-operator:main-backup
    serviceAccountName: percona-server-mongodb-operator
# annotations:
# iam.amazonaws.com/role: role-arn
# resources:
# limits:
# cpu: "300m"
# memory: "0.5G"
# requests:
# cpu: "300m"
# memory: "0.5G"
# storages:
# s3-us-west:
# type: s3
# s3:
# bucket: S3-BACKUP-BUCKET-NAME-HERE
# credentialsSecret: my-cluster-name-backup-s3
# region: us-west-2
# prefix: ""
# uploadPartSize: 10485760
# maxUploadParts: 10000
# storageClass: STANDARD
# insecureSkipTLSVerify: false
# minio:
# type: s3
# s3:
# bucket: MINIO-BACKUP-BUCKET-NAME-HERE
# region: us-east-1
# credentialsSecret: my-cluster-name-backup-minio
# endpointUrl: http://minio.psmdb.svc.cluster.local:9000/minio/
# insecureSkipTLSVerify: false
# prefix: ""
# azure-blob:
# type: azure
# azure:
# container: CONTAINER-NAME
# prefix: PREFIX-NAME
# credentialsSecret: SECRET-NAME
    pitr:
      enabled: false
# oplogSpanMin: 10
      compressionType: gzip
      compressionLevel: 6
# tasks:
# - name: daily-s3-us-west
# enabled: true
# schedule: "0 0 * * *"
# keep: 3
# storageName: s3-us-west
# compressionType: gzip
# compressionLevel: 6
# - name: weekly-s3-us-west
# enabled: false
# schedule: "0 0 * * 0"
# keep: 5
# storageName: s3-us-west
# compressionType: gzip
# compressionLevel: 6
# - name: weekly-s3-us-west-physical
# enabled: false
# schedule: "0 5 * * 0"
# keep: 5
# type: physical
# storageName: s3-us-west
# compressionType: gzip
# compressionLevel: 6

```

Trying to connect from within the mongos-pod, it looks the same:

```auto
[mongodb@my-cluster-name-mongos-0 db]$ mongosh --tls --host 127.0.0.1 --tlsAllowInvalidCertificates
Current Mongosh Log ID: 646395127955b98819e50c44
Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&tls=true&tlsAllowInvalidCertificates=true&appName=mongosh+1.6.2
MongoServerSelectionError: connection <monitor> to 127.0.0.1:27017 closed
[mongodb@my-cluster-name-mongos-0 db]$ mongosh --host 127.0.0.1                              
Current Mongosh Log ID: 646395230b7e67bbb9a8a699
Connecting to: mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000&appName=mongosh+1.6.2
Using MongoDB: 6.0.4-3
Using Mongosh: 1.6.2

For mongosh info see: https://docs.mongodb.com/mongodb-shell/

[direct: mongos] test> 

```

What’s the “missing link” here?

Thanks and kind regards.

---

<div class="post-metadata">

**Author:** ![rdxmbr](https://avatars.discourse-cdn.com/v4/letter/r/c2a13f/32.png) [@rdxmbr](https://forums.percona.com/u/rdxmbr)\
**Post date:** [May 16, 2023, 2:53pm UTC](https://forums.percona.com/t/solved-expose-mongos-with-tls/22084/2 "2023-05-16T14:53:26Z")

</div>

ok, that configuration needs a valid client-certificate to connect. So this is resolved.