CLOUDP-303643: Enable TLS certificate verification for e2e tests

[filipcirtog]

Summary

The existing tests were skipping TLS verification entirely, which meant they could silently pass even with misconfigured certificates or hostname mismatches. To resolve this, I replaced tls_verify=False with tls_verify=issuer_ca_filepath across all e2e tests so that TLS certificates are actually validated against the issuer CA during testing.

Proof of Work

• Regenerate test CA cert with proper X.509 extensions (basicConstraints, keyUsage, subjectKeyIdentifier) so certificate chain validation succeeds. Update the Makefile cert target.
• Add create_mongodb_sharded_tls_certs in certs.py which generates a single TLS certificate covering all sharded cluster components (mongos, shards, config servers), needed for Prometheus.
• Switch endpoint checks from tls_verify=False to tls_verify=issuer_ca_filepath
• Replace tlsAllowInvalidCertificates=True with tlsCAFile=issuer_ca_filepath for the PyMongo connection.

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you added changelog file?
  • use skip-changelog label if not needed
  • refer to Changelog files and Release Notes section in CONTRIBUTING.md for more details

[github-actions]

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.7.1 Release Notes

Other Changes

• Container images: Merged the init-database and init-appdb init container images into a single init-database image. The init-appdb image will no longer be published and does not affect existing deployments.

[Copilot]

Pull request overview

Enables TLS certificate verification (instead of verify=False / invalid cert allowances) across several e2e test suites by wiring in the issuer CA bundle and ensuring Prometheus endpoints for sharded clusters have certificates valid for all component hostnames.

Changes:

• Switch Prometheus endpoint checks to verify TLS using issuer_ca_filepath (requests verify path) across Ops Manager + Vault integration tests.
• Add create_mongodb_sharded_tls_certs() to generate a single cert covering all sharded cluster component DNS names (mongos/shards/configsvr), and use it for Prometheus TLS secrets.
• Refresh CA fixture material and update the make cert target to generate a CA cert with explicit CA extensions.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
docker/mongodb-kubernetes-tests/tests/vaultintegration/om_backup_vault.py	Uses issuer CA bundle for Prometheus HTTPS reachability checks; renames Prometheus cert helper for clarity.
docker/mongodb-kubernetes-tests/tests/vaultintegration/mongodb_deployment_vault.py	Adds sharded Prometheus TLS cert generation and enables TLS verification for Prometheus scraping checks.
docker/mongodb-kubernetes-tests/tests/opsmanager/withMonitoredAppDB/om_ops_manager_appdb_monitoring_tls.py	Switches PyMongo client to validate TLS using issuer CA instead of allowing invalid certs.
docker/mongodb-kubernetes-tests/tests/opsmanager/om_ops_manager_prometheus.py	Uses sharded-wide cert helper for sharded Prometheus endpoints and enables TLS verification in tests.
docker/mongodb-kubernetes-tests/tests/opsmanager/fixtures/ca-tls.key	Updates test CA private key fixture used by cert-manager issuer in e2e.
docker/mongodb-kubernetes-tests/tests/opsmanager/fixtures/ca-tls.crt	Updates test CA certificate fixture.
docker/mongodb-kubernetes-tests/tests/opsmanager/fixtures/ca-tls-full-chain.crt	Updates full-chain bundle used as issuer CA bundle in tests.
docker/mongodb-kubernetes-tests/kubetester/http.py	Allows passing a CA bundle path to requests verify for HTTPS reachability checks.
docker/mongodb-kubernetes-tests/kubetester/certs.py	Adds create_mongodb_sharded_tls_certs() to build a single cert SAN list spanning all sharded component hostnames.
Makefile	Updates cert target to generate CA cert with explicit CA extensions and key usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Type annotation for auth should reflect the actual (username, password) tuple that callers pass. Tuple[str] describes a single-element tuple; consider changing it to Tuple[str, str] (or tuple[str, str]) to avoid misleading hints / mypy issues.

Suggested change

	def https_endpoint_is_reachable(url: str, auth: Tuple[str], *, tls_verify: Union[bool, str]) -> bool:
	def https_endpoint_is_reachable(url: str, auth: Tuple[str, str], *, tls_verify: Union[bool, str]) -> bool: