密钥轮转时如何安全更新Mongoose连接凭证？

针对你遇到的凭证轮转时的竞态问题，这里有几个可落地的实现思路，无需手动暴力关闭连接，能保证现有查询完成后平滑切换：

1. 利用MongoDB驱动的动态凭证刷新，让连接池自动处理认证 #

MongoDB驱动本身支持在不关闭连接的情况下重新认证，结合Mongoose的连接实例，可直接调用底层驱动的认证方法刷新凭证，不用销毁整个连接池：

实现步骤： #

• 监听Vault凭证文件变化，获取新的用户名/密码
• 从Mongoose连接实例中获取底层MongoDB客户端
• 遍历连接池中的所有活跃连接，逐个重新认证
• 更新Mongoose连接配置，确保后续新创建的连接使用新凭证

代码示例（Nest.js服务中）： #

import { Injectable, OnModuleInit } from '@nestjs/common';
import { Connection } from 'mongoose';
import * as fs from 'fs';

@Injectable()
export class DbCredentialRefresher implements OnModuleInit {
  private credentialPath = '/vault/secrets/mongo-creds';
  private currentCreds: { user: string; pass: string };

  constructor(private readonly mongoConnection: Connection) {}

  async onModuleInit() {
    this.currentCreds = this.loadCredentials();
    fs.watch(this.credentialPath, async (eventType) => {
      if (eventType === 'change') await this.refreshMongoCredentials();
    });
  }

  private loadCredentials(): { user: string; pass: string } {
    const credsContent = fs.readFileSync(this.credentialPath, 'utf-8');
    return JSON.parse(credsContent);
  }

  private async refreshMongoCredentials() {
    const newCreds = this.loadCredentials();
    if (newCreds.user === this.currentCreds.user && newCreds.pass === this.currentCreds.pass) return;

    this.currentCreds = newCreds;
    const mongoClient = this.mongoConnection.getClient();

    // 遍历连接池，对每个活跃连接重新认证
    const connections = mongoClient.topology.s.replset?.connections || [];
    for (const conn of connections) {
      if (conn.isConnected()) await conn.auth(newCreds.user, newCreds.pass);
    }

    // 更新Mongoose连接配置，确保新连接用新凭证
    this.mongoConnection.set('user', newCreds.user);
    this.mongoConnection.set('pass', newCreds.pass);
  }
}

2. 双连接池平滑切换（活跃/备用） #

维护两个独立的Mongoose连接池，凭证更新时先初始化备用连接，待其就绪后将新请求路由到备用池，等旧池所有请求完成后再销毁旧池：

实现步骤： #

• 在Nest模块中创建activeConnection和standbyConnection两个连接实例
• 凭证变化时，用新凭证初始化备用连接并等待就绪
• 切换路由逻辑（通过DI容器或工厂类），将新请求导向备用连接
• 调用旧连接的close(true)方法，等待所有现有操作完成后关闭旧连接

代码示例（连接工厂）： #

import { Injectable, OnModuleInit } from '@nestjs/common';
import { createConnection, Connection } from 'mongoose';
import * as fs from 'fs';

@Injectable()
export class DbConnectionFactory implements OnModuleInit {
  private activeConnection: Connection;
  private standbyConnection: Connection;
  private credentialPath = '/vault/secrets/mongo-creds';
  private isRefreshing = false;

  async onModuleInit() {
    const initialCreds = this.loadCredentials();
    this.activeConnection = await createConnection(this.getMongoUri(initialCreds));
    fs.watch(this.credentialPath, async () => {
      if (!this.isRefreshing) await this.switchConnections();
    });
  }

  private async switchConnections() {
    this.isRefreshing = true;
    const newCreds = this.loadCredentials();
    
    // 初始化备用连接
    this.standbyConnection = await createConnection(this.getMongoUri(newCreds));
    await this.standbyConnection.asPromise();

    // 切换活跃连接
    const oldConn = this.activeConnection;
    this.activeConnection = this.standbyConnection;
    this.standbyConnection = null;

    // 等待旧连接所有操作完成后关闭
    await oldConn.close(true);
    this.isRefreshing = false;
  }

  private getMongoUri(creds: { user: string; pass: string }) {
    return `mongodb://${creds.user}:${creds.pass}@mongo-host:27017/db-name?authSource=admin`;
  }

  private loadCredentials() {
    const content = fs.readFileSync(this.credentialPath, 'utf-8');
    return JSON.parse(content);
  }

  getActiveConnection(): Connection {
    return this.activeConnection;
  }

  isRefreshingState(): boolean {
    return this.isRefreshing;
  }
}

3. 配置连接池优雅关闭+请求拦截 #

如果必须重启连接，可通过连接池参数配置优雅关闭策略，同时添加请求拦截器暂时拒绝新请求，直到新连接就绪：

关键配置与实现： #

• 关闭连接时使用close(true)，强制等待所有现有操作完成后关闭
• 新增Nest拦截器，在凭证刷新期间拦截新请求，返回503服务不可用提示

代码示例（请求拦截器）： #

import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
import { Observable, of } from 'rxjs';
import { DbConnectionFactory } from './db-connection.factory';

@Injectable()
export class DbRefreshInterceptor implements NestInterceptor {
  constructor(private readonly dbFactory: DbConnectionFactory) {}

  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    if (this.dbFactory.isRefreshingState()) {
      return of({ statusCode: 503, message: '数据库凭证更新中，请稍后重试' });
    }
    return next.handle();
  }
}

内容的提问来源于stack exchange，提问作者Daniel Loiterton