Add support for setting a per-node `saslHostName` for Kerberos/GSSAPI authentication

[shajia-deshaw]

Proposal

When MongoDB authentication uses GSSAPI (Kerberos), mongod derives the SASL service principal hostname from the node's own resolved hostname (hostname -f). Under the operator, mongod pods resolve to internal Kubernetes FQDNs (e.g. pod-0.<cluster>-rs0.<ns>.svc.cluster.<fully-qualified-domain>), which do not match the Kerberos SPN provisioned in the keytab - which is based on the "externally routable" / service-mesh hostname (e.g. pod-0.<ns>.svc.<fully-qualified-domain>).
FTR - that external name is exactly what the operator already advertises for each member when clusterServiceDNSMode: ServiceMesh is set (via clusterServiceDNSSuffix), so the correct SPN hostname is already known to the operator - it's just not fed into mongod's saslHostName.

As a result GSSAPI auth fails: the SPN mongod presents (mongodb/pod-0...svc.cluster.<fully-qualified-domain>) doesn't exist in the keytab / doesn't match the service principal name against which the clients are authenticating.

Fix:

We currently patched the ps-entry.sh to supply the right fqdns and it works. Happy to contribute it upstream if folks are interested. This fix was also found in MongoDB official docs

i.e.

 --setParameter "saslHostName=${SASL_HOSTNAME} // we need to form the SASL hostname per node via the script"

Use-Case

This helps us use Kerberos based authentication with Percona's MongoDB operator which the server already supports per https://docs.percona.com/percona-server-for-mongodb/8.3/kerberos.html

Is this a feature you are interested in implementing yourself?

Yes

Anything else?

No response

[egegunes]

I created https://perconadev.atlassian.net/browse/K8SPSMDB-1783 to track this.

@shajia-deshaw feel free to create a PR with your patch.