Merge remote-tracking branch 'origin/main' into K8SPSMDB-1211

pooknull · pooknull · commit fd8c741112ea · 2025-05-29T15:07:46.000+03:00
diff --git a/build/physical-restore-ps-entry.sh b/build/physical-restore-ps-entry.sh
@@ -21,6 +21,13 @@ trap 'handle_sigterm' 15
 
 touch /opt/percona/restore-in-progress
 
+if [[ -z ${PBM_AGENT_TLS_ENABLED} ]] || [[ ${PBM_AGENT_TLS_ENABLED} == "true" ]]; then
+	MONGO_SSL_DIR=/etc/mongodb-ssl
+	if [[ -e "${MONGO_SSL_DIR}/tls.crt" ]] && [[ -e "${MONGO_SSL_DIR}/tls.key" ]]; then
+		cat "${MONGO_SSL_DIR}/tls.key" "${MONGO_SSL_DIR}/tls.crt" >/tmp/tls.pem
+	fi
+fi
+
 /opt/percona/pbm-agent >${PBM_AGENT_LOG} 2>&1 &
 pbm_pid=$!
 
diff --git a/e2e-tests/demand-backup-incremental-sharded/compare/statefulset_some-name-rs0_restore_sharded-oc.yml b/e2e-tests/demand-backup-incremental-sharded/compare/statefulset_some-name-rs0_restore_sharded-oc.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-incremental-sharded/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-incremental-sharded/compare/statefulset_some-name-rs0_restore_sharded.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml b/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml b/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-incremental/compare/statefulset_some-name-rs0_restore.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-aws/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-physical-aws/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-aws/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-physical-aws/compare/statefulset_some-name-rs0_restore.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-azure/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-physical-azure/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-azure/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-physical-azure/compare/statefulset_some-name-rs0_restore.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-gcp/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-physical-gcp/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-gcp/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-physical-gcp/compare/statefulset_some-name-rs0_restore.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-arbiter-nv.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-oc.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore-oc.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore.yml b/e2e-tests/demand-backup-physical-minio/compare/statefulset_some-name-rs0_restore.yml
@@ -83,13 +83,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-sharded-aws/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-aws/compare/statefulset_some-name-rs0_restore_sharded.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-sharded-azure/compare/statefulset_some-name-rs0_restore_sharded-oc.yml b/e2e-tests/demand-backup-physical-sharded-azure/compare/statefulset_some-name-rs0_restore_sharded-oc.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-sharded-azure/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-azure/compare/statefulset_some-name-rs0_restore_sharded.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-sharded-gcp/compare/statefulset_some-name-rs0_restore_sharded-oc.yml b/e2e-tests/demand-backup-physical-sharded-gcp/compare/statefulset_some-name-rs0_restore_sharded-oc.yml
@@ -84,13 +84,17 @@ spec:
               value: "true"
             - name: PBM_AGENT_SIDECAR_SLEEP
               value: "5"
+            - name: PBM_AGENT_TLS_ENABLED
+              value: "true"
+            - name: PBM_MONGODB_PORT
+              value: "27017"
             - name: POD_NAME
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.name
             - name: PBM_MONGODB_URI
-              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@$(POD_NAME)
+              value: mongodb://$(PBM_AGENT_MONGODB_USERNAME):$(PBM_AGENT_MONGODB_PASSWORD)@localhost:$(PBM_MONGODB_PORT)/?tls=true&tlsCertificateKeyFile=/tmp/tls.pem&tlsCAFile=/etc/mongodb-ssl/ca.crt&tlsInsecure=true
           envFrom:
             - secretRef:
                 name: internal-some-name-users
diff --git a/e2e-tests/demand-backup-physical-sharded-gcp/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-gcp/compare/statefulset_some-name-rs0_restore_sharded.yml
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded-oc.yml b/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded-oc.yml
diff --git a/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-minio/compare/statefulset_some-name-rs0_restore_sharded.yml
diff --git a/e2e-tests/demand-backup-physical-sharded-parallel/compare/statefulset_some-name-rs0_restore_sharded.yml b/e2e-tests/demand-backup-physical-sharded-parallel/compare/statefulset_some-name-rs0_restore_sharded.yml
diff --git a/pkg/controller/perconaservermongodbrestore/physical.go b/pkg/controller/perconaservermongodbrestore/physical.go
diff --git a/pkg/controller/perconaservermongodbrestore/physical_test.go b/pkg/controller/perconaservermongodbrestore/physical_test.go
diff --git a/pkg/psmdb/statefulset.go b/pkg/psmdb/statefulset.go
