MongoDB Health Check fails when using Mongo template on Openshift

Describe the bug When configuring an application to point to a mongoDB instance deployed using the standard Openshift templates, the health check fails as it does not have the permissions to connect to the admin database. The openshift template creates an user with ReadWrite permissions that does not have the required permissions to list databases in admin db. There is also no config property to specify the admin password.

Expected behavior Expect the health check to return a good status

Actual behavior Health check fails with the following error message:

checks": [
        {
            "name": "MongoDB connection health check",
            "status": "DOWN",
            "data": {
                "reason": "Command failed with error 13 (Unauthorized): 'not authorized on admin to execute command { listDatabases: 1, nameOnly: true, $db: \"admin\" }' on server mongodb:27017. The full response is {\"ok\": 0.0, \"errmsg\": \"not authorized on admin to execute command { listDatabases: 1, nameOnly: true, $db: \\\"admin\\\" }\", \"code\": 13, \"codeName\": \"Unauthorized\"}"
            }
        }

To Reproduce Steps to reproduce the behavior:

1. Deploy a mongo db instance using the standard Openshift template:

oc new-app --template=mongodb-ephemeral --param=MONGODB_DATABASE=catalog -n ${namespace}

1. Deploy a simple application that uses panache/mongodb configured to connect with the normal user account provisioned by the Openshift template
2. Enable the smallrye-health extension
3. Verify /health or /health/ready endpoint

Configuration

# Add your application.properties here, if applicable.

quarkus.mongodb.connection-string = mongodb://mongodb:27017
quarkus.mongodb.database = catalog
quarkus.mongodb.credentials.username = [generated username]
quarkus.mongodb.credentials.password = [ generated password]

Environment (please complete the following information):

• Output of uname -a or ver: Openshift 4.x (ubi-minimal), pod: 4.18.0-147.5.1.el8_1.x86_64
• Output of java -version:

openjdk version "11.0.7" 2020-04-14 LTS
OpenJDK Runtime Environment 18.9 (build 11.0.7+10-LTS)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.7+10-LTS, mixed mode, sharing)

• GraalVM version (if different from Java): 20.0.0
• Quarkus version or git rev: 1.5.0-Final
• Build tool (ie. output of mvnw --version or gradlew --version): 3.6.3 Additional context (Add any other context about the problem here.)

[loicmathieu]

Doing this will change the response of the health check endpoint (the databases list is included inside the response). This will be a breaking change. I need to discuss with others to see what they think about it.

Or maybe I can fallback on using the ping command in case of Unauthorized exception but I’m not fan of this either.

[loicmathieu]

ping seems to be the better command to run.