MCK 1.11.0 Release Notes

New Features

MongoDBUser: Added optional spec.connectionStringDatabase to populate the database segment of the connection string URI path. spec.db continues to set the authSource parameter. For example, with spec.db of admin and spec.connectionStringDatabase of myapp, the generated secret is mongodb://user:pass@host/myapp?authSource=admin&....
kubectl-mongodb plugin: Added a --member-cluster-ca flag to kubectl mongodb multicluster setup and kubectl mongodb multicluster recover, taking a <member-cluster-name>=<path-to-pem-file> pair and repeatable once per cluster. The supplied PEM bundle replaces the certificate-authority-data entry that the generated KubeConfig would otherwise take from that cluster's ServiceAccount token secret. Use it when TLS is terminated differently on the network path the Operator takes to reach a member cluster's API server. Both commands now warn when they are about to replace a CA that does not come from the cluster's ServiceAccount token secret, so a custom CA is never dropped silently.

Escape the organization ID read from the project ConfigMap when building Ops Manager API request paths, preventing request forgery to arbitrary Ops Manager endpoints.
MongoDBUser: Fixed a bug in which connectionString.standardSrv secrets for clusters without TLS did not include ssl=false, causing SRV connection strings to assume TLS by default and fail to connect to non-TLS clusters. Both connectionString.standard and connectionString.standardSrv now explicitly set ssl=false when TLS is disabled.
MongoDBUser: Fixed the generated connection string secret carrying a SCRAM authMechanism (for example SCRAM-SHA-256) for users with spec.db: "$external" on deployments that enable SCRAM alongside external authentication. The secret now omits authMechanism so clients supply the appropriate external mechanism at connect time.
MongoDBUser: The connection string secret no longer contains an empty password key for users with spec.db: "$external". The key is omitted rather than written empty.
Changing metadata.labels on a MongoDBOpsManager resource no longer leaves it stuck in Failed state. The labels at the MongoDBOpsManager level are no longer propagating to the PersistentVolumeClaims of the AppDB and Backup Daemon StatefulSets.