|
| 1 | +## Enabling External Access to MongoDB deployment |
| 2 | + |
| 3 | +This guide assumes that the operator is installed and a MongoDB deployment is yet to be done but you have a chosen namespace that you are installing into. We will install cert-manager and then generate certificates and configure split-horizon to support internal and external DNS names for configuring external access to the replicaset. |
| 4 | + |
| 5 | +### Install cert-manager |
| 6 | + |
| 7 | +```sh |
| 8 | +kubectl create namespace cert-manager |
| 9 | +helm repo add jetstack https://charts.jetstack.io |
| 10 | +helm repo update |
| 11 | +helm install \ |
| 12 | + cert-manager jetstack/cert-manager \ |
| 13 | + --namespace cert-manager \ |
| 14 | + --version v1.3.1 \ |
| 15 | + --set installCRDs=true |
| 16 | +``` |
| 17 | + |
| 18 | +### Install mkcert and generate CA |
| 19 | + |
| 20 | +```sh |
| 21 | +brew install mkcert # for Mac |
| 22 | +#for Linux / Windows systems look at https://github.com/FiloSottile/mkcert |
| 23 | +mkcert -install |
| 24 | +``` |
| 25 | + |
| 26 | +Execute ```mkcert --CAROOT``` to note the location of the generated root CA key and cert. |
| 27 | + |
| 28 | +### Retrieve the CA and create configmaps and secrets |
| 29 | + |
| 30 | +Use the files that you found in the previous step. Replace ```<your-namespace>``` with your chosen namespace |
| 31 | + |
| 32 | +```sh |
| 33 | +kubectl create configmap ca-config-map --from-file=ca.crt --namespace <your-namespace> |
| 34 | + |
| 35 | +kubectl create secret tls ca-key-pair --cert=ca.crt --key=ca.key --namespace <your-namespace> |
| 36 | +``` |
| 37 | + |
| 38 | +### Create the Cert Manager issuer and secret |
| 39 | + |
| 40 | +Edit the file ```cert-manager-certificate.yaml``` to replace ```<mongodb-name>``` with your MongoDB deployment name. Also replace ```<domain-rs-1>```, ```<domain-rs-2>```, and ```<domain-rs-3>``` with the external FQDNs of the MongoDB replicaset members. Please remember that you will have to add an equal number of entries for each member of the replicaset. |
| 41 | + |
| 42 | +Apply the manifests. Replace ```<your-namespace>``` with the namespace you are using for the deployment. |
| 43 | + |
| 44 | +```sh |
| 45 | +kubectl apply -f config/samples/external_access/cert-manager-issuer.yaml --namespace <your-namespace> |
| 46 | +kubectl apply -f config/samples/external_access/cert-manager-certificate.yaml --namespace <your-namespace> |
| 47 | +``` |
| 48 | + |
| 49 | +### Create the MongoDB deployment |
| 50 | + |
| 51 | +Edit ```config/samples/external_access/mongodb.com_v1_mongodbcommunity_cr.yaml```. Replace <mongodb-name> with the desired MongoDB deployment name -- this should be the same as in the previous step. Replace ```<domain-rs-1>```, ```<domain-rs-2>```, and ```<domain-rs-3>``` with the external FQDNs of the MongoDB replicaset members. Please remember that you should have the same number of entries in this section as the number of your replicaset members. You can also edit the ports for external access to your preferred numbers in this section -- you will have to remember to change them in the next step too. Change ```<your-admin-password>``` to your desired admin password for MongoDB. |
| 52 | + |
| 53 | +Apply the manifest. |
| 54 | + |
| 55 | +```sh |
| 56 | +kubectl apply -f config/samples/external_access/mongodb.com_v1_mongodbcommunity_cr.yaml |
| 57 | +``` |
| 58 | + |
| 59 | +Wait for the replicaset to be available. |
| 60 | + |
| 61 | +### Create the external NodePort services for accessing the MongoDB deployment from outside the Kubernetes cluster |
| 62 | + |
| 63 | +Edit ```config/samples/external_access/external_services.yaml``` and replace ```<mongodb-name>``` with the MongoDB deployment name that you have used in the preceeding steps. You can change the ```nodePort``` and ```port``` to reflect the changes (if any) you have made in the previous steps. |
| 64 | + |
| 65 | +Apply the manifest. |
| 66 | + |
| 67 | +```sh |
| 68 | +kubectl apply -f config/samples/external_access/external_services.yaml |
| 69 | +``` |
| 70 | + |
| 71 | +### Retrieve the certificates from a MongoDB replicaset member |
| 72 | + |
| 73 | +```sh |
| 74 | +kubectl exec --namespace mcommunity -it <mongodb-name>-0 -c mongod -- bash |
| 75 | +``` |
| 76 | + |
| 77 | +Once inside the container ```cat``` and copy the contents of the ```.pem``` file in ```/var/lib/tls/server``` into a file on your local system. |
| 78 | + |
| 79 | +### Connect to the MongoDB deployment from outside the Kubernetes cluster |
| 80 | + |
| 81 | +This is an example to connect to the MongoDB cluster with Mongo shell. Use the CA from ```mkcert``` and the certificate from the previous step. Replace the values in the command from the preceeding steps. |
| 82 | + |
| 83 | +```sh |
| 84 | +mongosh --tls --tlsCAfile ca.crt --tlsCertificateKeyFile key.pem --username my-user --password <your-admin-password> mongodb://<domain-rs-1>:31181,<domain-rs-2>:31182,<domain-rs-3>:31183 |
| 85 | +``` |
| 86 | + |
| 87 | +### Conclusion |
| 88 | +At this point, you should be able to connect to the MongoDB deployment from outside the cluster. Make sure that you can resolve to the FQDNs for the replicaset members where you have the Mongo client installed. |
0 commit comments