Deploy an Ops Manager Resource

Configure kubectl to default to your namespace.

If you have not already, run the following command to execute all kubectl commands in the namespace you created.

kubectl config set-context $(kubectl config current-context) --namespace=<metadata.namespace>

Create secrets for your certificates.

If you're using HashiCorp Vault as your secret storage tool, you can Create a Vault Secret instead.

To learn about your options for secret storage, see Configure Secret Storage.

1. Once you have your TLS certificates and private keys, run the following command to create a secret that stores Ops Manager's TLS certificate:

   kubectl create secret tls <prefix>-<metadata.name>-cert \
     --cert=<om-tls-cert> \
     --key=<om-tls-key>

2. Run the following command to create a new secret that stores the application database's TLS certificate:

   kubectl create secret tls <prefix>-<metadata.name>-db-cert \
     --cert=<appdb-tls-cert> \
     --key=<appdb-tls-key>

If necessary, validate your TLS certificates.

If your Ops Manager TLS certificate or your application database TLS certificate is signed by a custom CA, you must provide a CA certificate to validate the TLS certificate(s). To validate the TLS certificate(s), create a ConfigMap to hold the CA certificate:

1. Obtain the entire TLS certificate chain for both Ops Manager and the application database from downloads.mongodb.com. The following openssl command outputs each certificate in the chain to your current working directory, in .crt format:

   openssl s_client -showcerts -verify 2 \
   -connect downloads.mongodb.com:443 -servername downloads.mongodb.com < /dev/null \
   | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}'

2. Concatenate your CA's certificate file for Ops Manager with the entire TLS certificate chain from downloads.mongodb.com that you obtained in the previous step:

   cat cert1.crt cert2.crt cert3.crt cert4.crt  >> mms-ca.crt

3. Concatenate your CA's certificate file for the application database with the entire TLS certificate chain from downloads.mongodb.com that you obtained in the previous step:

   cat cert1.crt cert2.crt cert3.crt cert4.crt  >> ca-pem

4. Create the ConfigMap for Ops Manager:

   kubectl create configmap om-http-cert-ca --from-file="mms-ca.crt"

5. Create the ConfigMap for the application database:

   kubectl create configmap ca --from-file="ca-pem"

Copy the following example Ops Manager Kubernetes object.

Change the highlighted settings to match your desired Ops Manager and application database configuration.

1
---
2
apiVersion: mongodb.com/v1
3
kind: MongoDBOpsManager
4
metadata:
5
  name: <myopsmanager>
6
spec:
7
  replicas: 1
8
  version: <opsmanagerversion>
9
  adminCredentials: <adminusercredentials> # Should match metadata.name
10
                                           # in the Kubernetes secret
11
                                           # for the admin user
12
13
  externalConnectivity:
14
    type: LoadBalancer
15
  security:
16
      certsSecretPrefix: <prefix> # Required. Text to prefix 
17
                                  # the name of the secret that contains
18
                                  # Ops Manager's TLS certificate.
19
      tls:
20
        ca: "om-http-cert-ca"  # Optional. Name of the ConfigMap file
21
                               # containing the certificate authority that
22
                               # signs the certificates used by the Ops
23
                               # Manager custom resource.
24
25
  applicationDatabase:
26
    members: 3
27
    version: "4.4.0-ubi8"
28
    security:
29
      certsSecretPrefix: <prefix> # Required. Text to prefix to the 
30
                                  # name of the secret that contains the Application
31
                                  # Database's TLS certificate. Name the secret 
32
                                  # <prefix>-<metadata.name>-db-cert.
33
      tls:
34
        ca: "appdb-ca" # Optional. Name of the ConfigMap file
35
                       # containing the certicate authority that
36
                       # signs the certificates used by the
37
                       # application database.
38
39
...

Open your preferred text editor and paste the object specification into a new text file.

Configure the settings highlighted in the prior example.

Optional: Configure Backup settings

If you want to enable Backup for your Ops Manager instance, you must configure all of the following settings:

You must also configure an S3 snapshot store or a blockstore.

To configure a snapshot store, configure the following settings:

To configure a blockstore, configure the following settings:

Optional: Configure any additional settings for an Ops Manager deployment.

Add any optional settings that you want to apply to your deployment to the object specification file.

Save this file with a .yaml file extension.

Create your Ops Manager instance.

Run the following kubectl command on the filename of the Ops Manager resource definition:

kubectl apply -f <opsmgr-resource>.yaml

kubectl apply \
  --context "$MDB_CENTRAL_CLUSTER_FULL_NAME" \
  --namespace "mongodb"
   -f https://raw.githubusercontent.com/mongodb/mongodb-enterprise-kubernetes/master/samples/ops-manager/ops-manager-external.yaml

Track the status of your Ops Manager instance.

To check the status of your Ops Manager resource, invoke the following command:

kubectl get om -o yaml -w

The command returns the following output under the status field while the resource deploys:

status:
 applicationDatabase:
  lastTransition: "2020-04-01T09:49:22Z"
  message: AppDB Statefulset is not ready yet
  phase: Reconciling
  type: ""
  version: ""
 backup:
  phase: ""
 opsManager:
  phase: ""

The Kubernetes Operator reconciles the resources in the following order:

1. Application Database.

2. Ops Manager.

3. Backup.

The Kubernetes Operator doesn't reconcile a resource until the preceding one enters the Running phase.

After the Ops Manager resource completes the Reconciling phase, the command returns the following output under the status field if you enabled Backup:

 status:
   applicationDatabase:
     lastTransition: "2020-04-01T09:50:20Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
  backup:
   lastTransition: "2020-04-01T09:57:42Z"
   message: The MongoDB object <namespace>/<oplogresourcename>
     doesn't exist
   phase: Pending
   opsManager:
     lastTransition: "2020-04-01T09:57:40Z"
     phase: Running
     replicas: 1
     url: https://om-svc.cloudqa.svc.cluster.local:8443
     version: "5.0.0"

Backup remains in a Pending state until you configure the Backup databases.

After the resource completes the Reconciling phase, the command returns the following output under the status field:

 status:
   applicationDatabase:
     lastTransition: "2019-12-06T18:23:22Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
   opsManager:
     lastTransition: "2019-12-06T18:23:26Z"
     message: The MongoDB object namespace/oplogdbname doesn't exist
     phase: Pending
     url: https://om-svc.dev.svc.cluster.local:8443
     version: ""

Backup remains in a Pending state until you configure the Backup databases.

Access the Ops Manager application.

The steps you take differ based on how you are routing traffic to the Ops Manager application in Kubernetes. If you configured the Kubernetes Operator to create a Kubernetes service for you, or you created a Kubernetes service manually, use one of the following methods to access the Ops Manager application:

To learn how to access the Ops Manager application using a third-party service, refer to the documentation for your solution.

Create credentials for the Kubernetes Operator.

To configure credentials, you must create an Ops Manager organization, generate programmatic API keys, and create a secret. These activities follow the prerequisites and procedure on the Create Credentials for the Kubernetes Operator page.

Create a project using a ConfigMap.

To create a project, follow the prerequisites and procedure on the Create One Project using a ConfigMap page.

Set the following fields in your project ConfigMap:

• Set data.baseUrl in the ConfigMap to the Ops Manager Application's URL. To find this URL, invoke the following command:

  
  

  kubectl get om -o yaml -w
  
  

  The command returns the URL of the Ops Manager Application in the status.opsManager.url field.

  
  

    status:
      applicationDatabase:
        lastTransition: "2019-12-06T18:23:22Z"
        members: 3
        phase: Running
        type: ReplicaSet
        version: "4.4.5-ubi8"
      opsManager:
        lastTransition: "2019-12-06T18:23:26Z"
        message: The MongoDB object namespace/oplogdbname doesn't exist
        phase: Pending
        url: https://om-svc.dev.svc.cluster.local:8443
        version: ""

  Important

  If you deploy Ops Manager with the Kubernetes Operator and Ops Manager will manage MongoDB database resources deployed outside of the Kubernetes cluster it's deployed to, you must set data.baseUrl to the same value of the spec.configuration.mms.centralUrl setting in the Ops Manager resource specification.

  Tip

  See also:

  Managing External MongoDB Deployments

• Set data.sslMMSCAConfigMap to the name of your ConfigMap containing the root CA certificate used to sign the Ops Manager host's certificate. The Kubernetes Operator requires that you name this Ops Manager resource's certificate mms-ca.crt in the ConfigMap.

Deploy MongoDB database resources to complete the Backup configuration.

By default, Ops Manager enables Backup. Create a MongoDB database resource for the oplog and snapshot stores to complete the configuration.

1. Deploy a MongoDB database resource for the oplog store in the same namespace as the Ops Manager resource.

   Note

   Create this database as a three-member replica set.

   Match the metadata.name of the resource with the spec.backup.opLogStores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

2. Deploy a MongoDB database resource for the S3 snapshot store in the same namespace as the Ops Manager resource.

   Note

   Create the S3 snapshot store as a replica set.

   Match the metadata.name of the resource to the spec.backup.s3Stores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

Confirm that the Ops Manager resource is running.

To check the status of your Ops Manager resource, invoke the following command:

kubectl get om -o yaml -w

When Ops Manager is running, the command returns the following output under the status field:

status:
  applicationDatabase:
    lastTransition: "2019-12-06T17:46:15Z"
    members: 3
    phase: Running
    type: ReplicaSet
    version: "4.4.5-ubi8"
  opsManager:
    lastTransition: "2019-12-06T17:46:32Z"
    phase: Running
    replicas: 1
    url: https://om-backup-svc.dev.svc.cluster.local:8443
    version: "5.0.0"

See Troubleshoot the Kubernetes Operator for information about the resource deployment statuses.

Configure kubectl to default to your namespace.

If you have not already, run the following command to execute all kubectl commands in the namespace you created.

kubectl config set-context $(kubectl config current-context) --namespace=<metadata.namespace>

Copy the following example Ops Manager Kubernetes object.

Change the highlighted settings to match your desired Ops Manager configuration.

1
---
2
apiVersion: mongodb.com/v1
3
kind: MongoDBOpsManager
4
metadata:
5
  name: <myopsmanager>
6
spec:
7
  replicas: 1
8
  version: <opsmanagerversion>
9
  adminCredentials: <adminusercredentials> # Should match metadata.name
10
                                           # in the secret
11
                                           # for the admin user
12
  externalConnectivity:
13
    type: LoadBalancer
14
15
  applicationDatabase:
16
    members: 3
17
    version: <mongodbversion>
18
...

Open your preferred text editor and paste the object specification into a new text file.

Configure the settings included in the prior example.

Optional: Configure backup settings.

If you want to enable backup, you must configure all of the following settings:

You must also configure an S3 snapshot store or a blockstore.

To configure an S3 snapshot store, configure the following settings:

To configure a blockstore, configure the following settings:

Optional: Configure any additional settings for an Ops Manager backup.

Add any optional settings for backups that you want to apply to your deployment to the object specification file. For example, for each type of backup store, and for Ops Manager backup daemon processes, you can assign labels to associate particular backup backup stores or backup daemon processes with specific projects. Use spec.backup.[*].assignmentLabels elements of the OpsManager resources.

Optional: Configure any additional settings for an Ops Manager deployment.

Add any optional settings that you want to apply to your deployment to the object specification file.

Save this file with a .yaml file extension.

Create your Ops Manager instance.

Run the following kubectl command on the filename of the Ops Manager resource definition:

kubectl apply -f <opsmgr-resource>.yaml

kubectl apply \
  --context "$MDB_CENTRAL_CLUSTER_FULL_NAME" \
  --namespace "mongodb"
   -f https://raw.githubusercontent.com/mongodb/mongodb-enterprise-kubernetes/master/samples/ops-manager/ops-manager-external.yaml

Track the status of your Ops Manager instance.

To check the status of your Ops Manager resource, invoke the following command:

kubectl get om -o yaml -w

The command returns the following output under the status field while the resource deploys:

status:
 applicationDatabase:
  lastTransition: "2020-04-01T09:49:22Z"
  message: AppDB Statefulset is not ready yet
  phase: Reconciling
  type: ""
  version: ""
 backup:
  phase: ""
 opsManager:
  phase: ""

The Kubernetes Operator reconciles the resources in the following order:

1. Application Database.

2. Ops Manager.

3. Backup.

The Kubernetes Operator doesn't reconcile a resource until the preceding one enters the Running phase.

After the Ops Manager resource completes the Reconciling phase, the command returns the following output under the status field if you enabled backup:

 status:
   applicationDatabase:
     lastTransition: "2020-04-01T09:50:20Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
  backup:
   lastTransition: "2020-04-01T09:57:42Z"
   message: The MongoDB object <namespace>/<oplogresourcename>
     doesn't exist
   phase: Pending
   opsManager:
     lastTransition: "2020-04-01T09:57:40Z"
     phase: Running
     replicas: 1
     url: http://om-svc.cloudqa.svc.cluster.local:8080
     version: "5.0.0"

Backup remains in a Pending state until you configure the backup databases.

Access the Ops Manager application.

The steps you take differ based on how you are routing traffic to the Ops Manager application in Kubernetes. If you configured the Kubernetes Operator to create a Kubernetes service for you, or you created a Kubernetes service manually, use one of the following methods to access the Ops Manager application:

To learn how to access the Ops Manager application using a third-party service, refer to the documentation for your solution.

Optional: Create credentials for the Kubernetes Operator.

If you enabled backup, you must create an Ops Manager organization, generate programmatic API keys, and create a secret in your secret-storage-tool. These activities follow the prerequisites and procedure on the Create Credentials for the Kubernetes Operator page.

Optional: Create a project using a ConfigMap.

If you enabled backup, create a project by following the prerequisites and procedure on the Create One Project using a ConfigMap page.

You must set data.baseUrl in the ConfigMap to the Ops Manager Application's URL. To find this URL, invoke the following command:

kubectl get om -o yaml -w

The command returns the URL of the Ops Manager Application in the status.opsManager.url field.

 status:
   applicationDatabase:
     lastTransition: "2020-04-01T10:00:32Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
  backup:
   lastTransition: "2020-04-01T09:57:42Z"
   message: The MongoDB object <namespace>/<oplogresourcename>
     doesn't exist
   phase: Pending
   opsManager:
     lastTransition: "2020-04-01T09:57:40Z"
     phase: Running
     replicas: 1
     url: http://om-svc.cloudqa.svc.cluster.local:8080
     version: "5.0.0"

Optional: Deploy MongoDB database resources to complete the backup configuration.

If you enabled Backup, create a MongoDB database resource for the oplog and snapshot stores to complete the configuration.

1. Deploy a MongoDB database resource for the oplog store in the same namespace as the Ops Manager resource.

   Note

   Create this database as a replica set.

   Match the metadata.name of the resource with the spec.backup.opLogStores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

2. Choose one of the following:

   1. Deploy a MongoDB database resource for the blockstore in the same namespace as the Ops Manager resource.

      Match the metadata.name of the resource to the spec.backup.blockStores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

   2. Configure an S3 bucket to use as the S3 snapshot store.

      Ensure that you can access the S3 bucket using the details that you specified in your Ops Manager resource definition.

Optional: Confirm that the Ops Manager resource is running.

If you enabled backup, check the status of your Ops Manager resource by invoking the following command:

kubectl get om -o yaml -w

When Ops Manager is running, the command returns the following output under the status field:

status:
  applicationDatabase:
    lastTransition: "2020-04-01T10:00:32Z"
    members: 3
    phase: Running
    type: ReplicaSet
    version: "4.4.5-ubi8"
  backup:
    lastTransition: "2020-04-01T10:00:53Z"
    phase: Running
    version: "4.2.8"
  opsManager:
    lastTransition: "2020-04-01T10:00:34Z"
    phase: Running
    replicas: 1
    url: http://om-svc.cloudqa.svc.cluster.local:8080
    version: "5.0.0"

See Troubleshoot the Kubernetes Operator for information about the resource deployment statuses.