Plan Your Ops Manager Resource

Encryption Key

The Kubernetes Operator generates an encryption key to protect sensitive information in the Ops Manager Application Database. The Kubernetes Operator saves this key in a secret in the same namespace as the Ops Manager resource. The Kubernetes Operator names the secret <om-resource-name>-gen-key.

If you remove the Ops Manager resource, the key remains stored in the secret on the Kubernetes cluster. If you stored the Application Database in a Persistent Volume and you create another Ops Manager resource with the same name, the Kubernetes Operator reuses the secret. If you create an Ops Manager resource with a different name, then Kubernetes Operator creates a new secret and Application Database, and the old secret isn't reused.

Application Database

Streamlined Configuration

After you deploy Ops Manager, you need to configure it. The regular procedure involves setting up Ops Manager through the configuration wizard. If you set some essential settings in your object specification before you deploy, you can bypass the configuration wizard.

In the spec.configuration block of your Ops Manager object specification, you need to:

• Add mms.ignoreInitialUiSetup and set to true.

• Add the minimum configuration settings to allow the Ops Manager instance to start without errors.

1
spec:
2
  configuration:
3
    mms.ignoreInitialUiSetup: "true"
4
    automation.versions.source: "remote"
5
    mms.adminEmailAddr: cloud-manager-support@mongodb.com
6
    mms.fromEmailAddr: cloud-manager-support@mongodb.com
7
    mms.mail.hostname: email-smtp.us-east-1.amazonaws.com
8
    mms.mail.port: "465"
9
    mms.mail.ssl: "true"
10
    mms.mail.transport: smtp
11
    mms.minimumTLSVersion: TLSv1.2
12
    mms.replyToEmailAddr: cloud-manager-support@mongodb.com

Backup

Kubernetes Operator enables Backup by default. The Kubernetes Operator deploys a StatefulSet comprised of one pod to host the Backup Daemon Service, and then creates a Persistent Volume Claim and Persistent Volume for the Backup Daemon's head database. The Kubernetes Operator uses the Ops Manager API to enable the Backup Daemon and configure the head database.

Configure Ops Manager to Run over HTTPS

You can configure your Ops Manager instance created through the Kubernetes Operator to run over HTTPS instead of HTTP.

To configure your Ops Manager instance to run over HTTPS:

1. Create a secret that contains the TLS certificate and private key.

2. Add this secret to the Ops Manager configuration object.

For detailed instructions, see Deploy an Ops Manager Resource.

Ops Manager Application Access

By default, the Kubernetes Operator doesn't create a Kubernetes service to route traffic originating from outside of the Kubernetes cluster to the Ops Manager application.

To access the Ops Manager application, you can:

• Configure the Kubernetes Operator to create a Kubernetes service.

• Create a Kubernetes service manually. MongoDB recommends using a LoadBalancer Kubernetes service if your cloud provider supports it.

• If you're using OpenShift, use routes.

• Use a third-party service, such as Istio.

The simplest method is configuring the Kubernetes Operator to create a Kubernetes service that routes external traffic to the Ops Manager application. The Ops Manager deployment procedure instructs you to add the following settings to the object specification that configures the Kubernetes Operator to create a service:

• spec.externalConnectivity

• spec.externalConnectivity.type

Deploying Ops Manager in Remote or Local Mode

You can use the Kubernetes Operator to configure Ops Manager to operate in Local or Remote mode if your environment prevents granting hosts in your Kubernetes cluster access to the Internet. In these modes, the Backup Daemons and managed MongoDB resources download installation archives from Ops Manager instead of from the Internet:

• Configure an Ops Manager Resource to use Remote Mode: Ops Manager reads the installation archives from HTTP endpoints on a web server or S3-compatible file store deployed to your Kubernetes cluster.

• Configure an Ops Manager Resource to use Local Mode: Ops Manager reads the instalation archives from a Persistent Volume that you create for the Ops Manager StatefulSet.

Managing External MongoDB Deployments

When you deploy Ops Manager with the Kubernetes Operator, Ops Manager can manage MongoDB database resources deployed:

• To the same Kubernetes cluster as Ops Manager.

• Outside of Kubernetes clusters.

If Ops Manager manages MongoDB database resources deployed to different Kubernetes clusters than Ops Manager or outside of Kubernetes clusters, you must:

1. Add the mms.centralUrl setting to spec.configuration in the Ops Manager resource specification.

   Set the value to the URL by which Ops Manager is exposed outside of the Kubernetes cluster:

   spec:
     configuration:
       mms.centralUrl: https://a9a8f8566e0094380b5c257746627b82-1037623671.us-east-1.elb.example.com:8080/

2. Update the ConfigMaps referenced by all MongoDB database resources inside the Kubernetes cluster that you deployed with the Kubernetes Operator.

   Set data.baseUrl to the same value of the spec.configuration.mms.centralUrl setting in the Ops Manager resource specification.

   Important

   This includes the ConfigMaps that the MongoDB database resources for the oplog and snapshot stores reference.

Using Ops Manager with Multi-Kubernetes-Cluster Deployments

To deploy an Ops Manager instance in the central cluster and connect to it, use the following procedures:

• Review the Ops Manager resource architecture

• Review the Ops Manager resource considerations and prerequisites

• Deploy an Ops Manager instance on the central cluster with TLS encryption

These procedures are the same as the procedures for single clusters deployed with the Kubernetes Operator with the following exceptions:

• Run the procedures to deploy Ops Manager only on the central cluster of your multi-Kubernetes-cluster deployment.

• Set the context and the namespace.

  If you are deploying an Ops Manager resource on a multi-Kubernetes-cluster deployment:

  • Set the context to the name of the central cluster, such as: kubectl config set context "$MDB_CENTRAL_CLUSTER_FULL_NAME".

  • Set the --namespace to the same scope that you used for your multi-Kubernetes-cluster deployment, such as: kubectl config --namespace "mongodb".

• Configure external connectivity for Ops Manager.

  To connect member clusters to the Ops Manager resource's deployment in the central cluster in a multi-Kubernetes-cluster deployment, use one of the following methods:

  • Set the spec.externalConnectivity to true and specify the Ops Manager port in it. Use the ops-manager-external.yaml example script, modify it to your needs, and apply the configuration. For example, run:

    kubectl apply \
     --context "$MDB_CENTRAL_CLUSTER_FULL_NAME" \
     --namespace "mongodb" \
      -f https://raw.githubusercontent.com/mongodb/mongodb-enterprise-kubernetes/master/samples/ops-manager/ops-manager-external.yaml

  • Add the central cluster and all member clusters to the service mesh. The service mesh establishes communication from the central and all member clusters to the Ops Manager instance. To learn more, see the Multi-Kubernetes-Cluster Quick Start procedures and see the step that references the istio-injection=enabled label for Istio. Also, see Automatic sidecar injection in the Istio documentation.