mlaunch: Support --ssl option to automatically setup a fully SSL-enabled cluster

[devkev]

Assuming you already have an SSL-enabled build. Currently you have to muck about generating a keypair with openssl, followed by adding --sslOnNormalPorts and --sslPEMKeyFile <filename> to the command line.

[rueckstiess]

Can you help me with that? I haven't played around with SSL yet. Can I tell if a build has SSL enabled? For example by parsing the --help output or someting?

[devkev]

That would probably work. But rather than trying to second guess whether it's there (which is needlessly fragile/racy in general), wouldn't it just be better to just do it, and see if the mongod exits with an error?

I believe the necessary steps are to create a PEM file (not sure if there is a more portable way than calling out to the openssl utility), then add the --sslOnNormalPorts --sslPEMKeyFile /path/to/pem/file.pem options.

If the build lacks SSL support, it will just fail to accept the --sslOnNormalPorts option, same as any other option it doesn't understand:

$ mongod --sslOnNormalPorts
error command line: unknown option sslOnNormalPorts
use --help for help
$ echo $?
1

Are such errors currently caught and returned to the user? If so, I think this would be explanatory enough. If not, and the failure is completely silent (except that doing mlaunch list after mlaunch init --ssl shows everything down), then that would not be good. :)

[stennie]

Fixed with PR#524

[p-mongo]

#524 adds a bunch of SSL options but it does not appear that it has any functionality to generate the apparently required pem file to launch an SSL-enabled cluster.