Manage Database Users Using SCRAM Authentication

Configure kubectl to default to your namespace.

If you have not already, run the following command to execute all kubectl commands in the namespace you created.

kubectl config set-context $(kubectl config current-context) --namespace=<metadata.namespace>

Copy the following example secret.

You can choose to use a cleartext password:

1
---
2
apiVersion: v1
3
kind: Secret
4
metadata:
5
  name: <mms-user-1-password>
6
  # corresponds to user.spec.passwordSecretKeyRef.name
7
type: Opaque
8
stringData:
9
  password: <my-plain-text-password>
10
  # corresponds to user.spec.passwordSecretKeyRef.key
11
data:
12
  password: <base-64-encoded-password>
13
  # corresponds to user.spec.passwordSecretKeyRef.key
14
...

or you can choose to use a Base64-encoded password:

1
---
2
apiVersion: v1
3
kind: Secret
4
metadata:
5
  name: <mms-user-1-password>
6
  # corresponds to user.spec.passwordSecretKeyRef.name
7
type: Opaque
8
stringData:
9
  password: <my-plain-text-password>
10
  # corresponds to user.spec.passwordSecretKeyRef.key
11
data:
12
  password: <base-64-encoded-password>
13
  # corresponds to user.spec.passwordSecretKeyRef.key
14
...

Create a new User Secret YAML file.

1. Open your preferred text editor.

2. Paste this User Secret into a new text file.

If you're using HashiCorp Vault as your secret storage tool, you can Create a Vault Secret instead.

To learn about your options for secret storage, see Configure Secret Storage.

Change the highlighted lines.

Use the following table to guide you through changing the highlighted lines in the Secret:

Save the User Secret file with a .yaml extension.

Copy the following example MongoDBUser.

---
apiVersion: mongodb.com/v1
kind: MongoDBUser
metadata:
  name: <mms-scram-user-1>
spec:
  passwordSecretKeyRef:
    name: <mms-user-1-password>
    # Match to metadata.name of the User Secret
    key: password
  username: "<mms-scram-user-1>"
  db: "admin" #
  mongodbResourceRef:
    name: "<my-replica-set>"
    # Match to MongoDB resource using authenticaiton
  roles:
    - db: "admin"
      name: "clusterAdmin"
    - db: "admin"
      name: "userAdminAnyDatabase"
    - db: "admin"
      name: "readWrite"
    - db: "admin"
      name: "userAdminAnyDatabase"
...

Create a new MongoDBUser file.

1. Open your preferred text editor.

2. Paste this MongoDBUser into a new YAML file.

Change the highlighted lines.

Use the following table to guide you through changing the highlighted lines in the MongoDB User Resource Specification:

Add any additional roles for the user to the MongoDBUser.

You may grant additional roles to this user.

Save the MongoDBUser file with a .yaml extension.

Create the user.

Invoke the following Kubernetes command to create your database user:

kubectl apply -f <database-user-conf>.yaml

When you create a new MongoDB database user, Kubernetes Operator automatically creates a new Kubernetes secret. The Kubernetes secret contains the following information about the new database user:

• username: Username for the database user

• password: Password for the database user

• connectionString.standard: Standard connection string that can connect you to the database as this database user.

• connectionString.standardSrv: DNS seed list connection string that can connect you to the database as this database user.

You can use these credentials to Connect to a MongoDB Database Resource from Inside Kubernetes.

View the newly created user in Cloud Manager or Ops Manager.

You can view the newly-created user in Cloud Manager or Ops Manager:

1. From the Project's Deployment view, click the Security tab.

2. Click the MongoDB Users nested tab.