Install MongoDB Search and Vector Search on a Single Cluster

1
# ============================================================================
2
# KUBERNETES CONFIGURATION
3
# ============================================================================
4
5
# Your Kubernetes context name (run: kubectl config get-contexts)
6
export K8S_CTX="<local cluster context>"
7
8
# Namespace where MongoDB Search and operator-managed cluster will be deployed
9
export MDB_NS="mongodb"
10
11
# ============================================================================
12
# CLUSTER NAMING
13
# ============================================================================
14
15
# Name for the operator-managed MongoDB replica set and MongoDBSearch resource
16
# (same name for both -- operator infers the reference)
17
export MDB_RESOURCE_NAME="mdb-rs"
18
19
# ============================================================================
20
# OPS MANAGER / CLOUD MANAGER
21
# ============================================================================
22
23
export OPS_MANAGER_PROJECT_NAME="<arbitrary project name>"
24
export OPS_MANAGER_API_URL="<SET API URL>"
25
export OPS_MANAGER_API_USER="<SET API USER>"
26
export OPS_MANAGER_API_KEY="<SET API KEY>"
27
export OPS_MANAGER_ORG_ID="<SET ORG ID>"
28
29
# ============================================================================
30
# MONGODB VERSION
31
# ============================================================================
32
33
# Minimum required MongoDB version for Search is 8.2
34
export MDB_VERSION="8.3.4-ent"
35
36
# ============================================================================
37
# USER CREDENTIALS (change these in production!)
38
# ============================================================================
39
40
export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
41
export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
42
export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
43
44
# ============================================================================
45
# OPERATOR CONFIGURATION
46
# ============================================================================
47
48
export OPERATOR_HELM_CHART="oci://quay.io/mongodb/helm-charts/mongodb-kubernetes"
49
export OPERATOR_ADDITIONAL_HELM_VALUES=""
50
51
# ============================================================================
52
# TLS CONFIGURATION
53
# ============================================================================
54
55
export MDB_TLS_CERT_SECRET_PREFIX="certs"
56
export MDB_TLS_CA_CONFIGMAP="${MDB_RESOURCE_NAME}-ca"
57
58
export CERT_MANAGER_NAMESPACE="cert-manager"
59
export MDB_TLS_SELF_SIGNED_ISSUER="selfsigned-bootstrap-issuer"
60
export MDB_TLS_CA_CERT_NAME="my-selfsigned-ca"
61
export MDB_TLS_CA_SECRET_NAME="root-secret"
62
export MDB_TLS_CA_ISSUER="my-ca-issuer"
63
64
# ============================================================================
65
# REPLICA SET TOPOLOGY
66
# ============================================================================
67
68
export MDB_RS_MEMBERS=3
69
70
# ============================================================================
71
# SEARCH CONFIGURATION
72
# ============================================================================
73
export MDB_MONGOT_REPLICAS=2
74
75
# ============================================================================
76
# DERIVED VALUES (computed from topology + search config above)
77
# ============================================================================
78
79
# Envoy proxy port (operator default)
80
ENVOY_PROXY_PORT="27028"
81
82
# Proxy service name (operator-derived, do not change)
83
export MDB_PROXY_HOST="${MDB_RESOURCE_NAME}-search-0-proxy-svc.${MDB_NS}.svc.cluster.local:${ENVOY_PROXY_PORT}"
84
85
# RS member hosts (operator naming convention)
86
export MDB_RS_HOST_0="${MDB_RESOURCE_NAME}-0.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
87
export MDB_RS_HOST_1="${MDB_RESOURCE_NAME}-1.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
88
export MDB_RS_HOST_2="${MDB_RESOURCE_NAME}-2.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
89
90
# Connection strings (built from RS member hosts)
91
export MDB_ADMIN_CONNECTION_STRING="mongodb://mdb-admin:${MDB_ADMIN_USER_PASSWORD}@${MDB_RS_HOST_0},${MDB_RS_HOST_1},${MDB_RS_HOST_2}/?replicaSet=${MDB_RESOURCE_NAME}&tls=true&tlsCAFile=/tls/ca-pem&authSource=admin&authMechanism=SCRAM-SHA-256"
92
export MDB_USER_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_RS_HOST_0},${MDB_RS_HOST_1},${MDB_RS_HOST_2}/?replicaSet=${MDB_RESOURCE_NAME}&tls=true&tlsCAFile=/tls/ca-pem&authSource=admin&authMechanism=SCRAM-SHA-256"

1
echo "Validating environment variables..."
2
3
required_vars=(
4
  "K8S_CTX"
5
  "MDB_NS"
6
  "MDB_RESOURCE_NAME"
7
  "MDB_VERSION"
8
  "MDB_ADMIN_USER_PASSWORD"
9
  "MDB_USER_PASSWORD"
10
  "MDB_SEARCH_SYNC_USER_PASSWORD"
11
  "MDB_RS_MEMBERS"
12
  "MDB_MONGOT_REPLICAS"
13
  "MDB_PROXY_HOST"
14
  "MDB_ADMIN_CONNECTION_STRING"
15
  "MDB_USER_CONNECTION_STRING"
16
)
17
18
missing_vars=()
19
for var in "${required_vars[@]}"; do
20
  [[ -n "${!var:-}" ]] && [[ "${!var}" != "<"* ]] || missing_vars+=("${var}")
21
done
22
23
if (( ${#missing_vars[@]} )); then
24
  echo "ERROR: Missing required environment variables:" >&2
25
  for m in "${missing_vars[@]}"; do echo "  - ${m}" >&2; done
26
  echo "Please edit env_variables.sh and set these values before proceeding." >&2
27
elif ! kubectl config get-contexts "${K8S_CTX}" &>/dev/null; then
28
  echo "ERROR: Kubernetes context '${K8S_CTX}' does not exist." >&2
29
  kubectl config get-contexts -o name
30
else
31
  echo "[ok] All required environment variables are set"
32
  echo "  Kubernetes context: ${K8S_CTX}"
33
  echo "  Namespace: ${MDB_NS}"
34
  echo "  Resource name: ${MDB_RESOURCE_NAME}"
35
  echo "  RS members: ${MDB_RS_MEMBERS}"
36
  echo "  Mongot replicas: ${MDB_MONGOT_REPLICAS}"
37
  echo "  Proxy host: ${MDB_PROXY_HOST}"
38
fi

1
kubectl create namespace "${MDB_NS}" --context "${K8S_CTX}" --dry-run=client -o yaml | \
2
  kubectl apply --context "${K8S_CTX}" -f -
3
4
echo "[ok] Namespace '${MDB_NS}' ready"

1
helm upgrade --install --debug --kube-context "${K8S_CTX}" \
2
  --create-namespace --namespace="${MDB_NS}" \
3
  mongodb-kubernetes \
4
  ${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
5
  "${OPERATOR_HELM_CHART}"

1
echo "Creating Ops Manager connection resources..."
2
3
# Create the credentials secret with API key
4
kubectl create secret generic om-credentials \
5
  --from-literal="user=${OPS_MANAGER_API_USER}" \
6
  --from-literal="publicApiKey=${OPS_MANAGER_API_KEY}" \
7
  --namespace="${MDB_NS}" \
8
  --context "${K8S_CTX}" \
9
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
10
11
# Create the project ConfigMap
12
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
13
apiVersion: v1
14
kind: ConfigMap
15
metadata:
16
  name: om-project
17
data:
18
  baseUrl: "${OPS_MANAGER_API_URL}"
19
  orgId: "${OPS_MANAGER_ORG_ID}"
20
  projectName: "${OPS_MANAGER_PROJECT_NAME}"
21
EOF
22
23
echo "[ok] Ops Manager resources created"
24
echo "  - Secret: om-credentials"
25
echo "  - ConfigMap: om-project"

1
echo "Installing cert-manager..."
2
3
# Check if cert-manager is already installed
4
if kubectl get namespace "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" &>/dev/null \
5
  && kubectl get deployment cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" &>/dev/null; then
6
  echo "cert-manager is already installed, skipping installation"
7
  kubectl rollout status deployment/cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=60s
8
  echo "[ok] cert-manager is ready"
9
else
10
  kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml \
11
    --context "${K8S_CTX}"
12
13
  echo "Waiting for cert-manager to be ready..."
14
  kubectl rollout status deployment/cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
15
  kubectl rollout status deployment/cert-manager-webhook -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
16
  kubectl rollout status deployment/cert-manager-cainjector -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
17
18
  echo "[ok] cert-manager installed and ready"
19
fi

1
echo "Configuring TLS prerequisites..."
2
3
kubectl apply --context "${K8S_CTX}" -f - <<EOF
4
apiVersion: cert-manager.io/v1
5
kind: ClusterIssuer
6
metadata:
7
  name: ${MDB_TLS_SELF_SIGNED_ISSUER}
8
spec:
9
  selfSigned: {}
10
EOF
11
12
echo "  [ok] Self-signed ClusterIssuer created"
13
14
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
15
apiVersion: cert-manager.io/v1
16
kind: Certificate
17
metadata:
18
  name: ${MDB_TLS_CA_CERT_NAME}
19
spec:
20
  isCA: true
21
  commonName: mongodb-ca
22
  secretName: ${MDB_TLS_CA_SECRET_NAME}
23
  duration: 87600h  # 10 years
24
  renewBefore: 8760h  # 1 year
25
  privateKey:
26
    algorithm: ECDSA
27
    size: 256
28
  issuerRef:
29
    name: ${MDB_TLS_SELF_SIGNED_ISSUER}
30
    kind: ClusterIssuer
31
EOF
32
33
echo "  [ok] CA Certificate requested"
34
35
echo "  Waiting for CA certificate..."
36
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CA_CERT_NAME}" \
37
  -n "${CERT_MANAGER_NAMESPACE}" \
38
  --context "${K8S_CTX}" \
39
  --timeout=60s
40
41
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
42
apiVersion: cert-manager.io/v1
43
kind: ClusterIssuer
44
metadata:
45
  name: ${MDB_TLS_CA_ISSUER}
46
spec:
47
  ca:
48
    secretName: ${MDB_TLS_CA_SECRET_NAME}
49
EOF
50
51
echo "  [ok] CA Issuer created"
52
53
echo "[ok] TLS prerequisites configured"

1
echo "Configuring CA certificate (ConfigMap) for mongod..."
2
3
mkdir -p certs
4
5
kubectl get secret "${MDB_TLS_CA_SECRET_NAME}" \
6
  -n "${CERT_MANAGER_NAMESPACE}" \
7
  --context "${K8S_CTX}" \
8
  -o jsonpath='{.data.tls\.crt}' | base64 -d > certs/ca-pem
9
10
kubectl create configmap "${MDB_TLS_CA_CONFIGMAP}" \
11
  --from-file=ca-pem=certs/ca-pem \
12
  --from-file=ca.crt=certs/ca-pem \
13
  -n "${MDB_NS}" \
14
  --context "${K8S_CTX}" \
15
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
16
17
echo "[ok] CA ConfigMap configured for mongod"

1
echo "Configuring CA certificate (Secret) for mongot..."
2
3
mkdir -p certs
4
5
kubectl get secret "${MDB_TLS_CA_SECRET_NAME}" \
6
  -n "${CERT_MANAGER_NAMESPACE}" \
7
  --context "${K8S_CTX}" \
8
  -o jsonpath='{.data.tls\.crt}' | base64 -d > certs/ca.crt
9
10
kubectl create secret generic "${MDB_TLS_CA_SECRET_NAME}" \
11
  --from-file=ca.crt=certs/ca.crt \
12
  -n "${MDB_NS}" \
13
  --context "${K8S_CTX}" \
14
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
15
16
echo "[ok] CA Secret configured for mongot"

1
echo "Generating TLS certificate for MongoDB replica set..."
2
3
echo "Creating certificate for RS ${MDB_RESOURCE_NAME}..."
4
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
5
apiVersion: cert-manager.io/v1
6
kind: Certificate
7
metadata:
8
  name: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-cert
9
spec:
10
  secretName: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-cert
11
  duration: 8760h    # 1 year
12
  renewBefore: 720h  # 30 days
13
  privateKey:
14
    algorithm: RSA
15
    size: 2048
16
  usages:
17
    - server auth
18
    - client auth
19
  dnsNames:
20
    - "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
21
  issuerRef:
22
    name: ${MDB_TLS_CA_ISSUER}
23
    kind: ClusterIssuer
24
EOF
25
echo "  [ok] Certificate requested for RS ${MDB_RESOURCE_NAME}"
26
27
echo ""
28
echo "Waiting for certificate to be ready..."
29
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-cert" \
30
  -n "${MDB_NS}" \
31
  --context "${K8S_CTX}" \
32
  --timeout=60s
33
34
echo "[ok] MongoDB RS TLS certificate created"

1
# ============================================================================
2
# KUBERNETES CONFIGURATION
3
# ============================================================================
4
5
# Your Kubernetes context name (run: kubectl config get-contexts)
6
export K8S_CTX="<local cluster context>"
7
8
# Namespace where MongoDB Search and operator-managed cluster will be deployed
9
export MDB_NS="mongodb"
10
11
# ============================================================================
12
# CLUSTER NAMING
13
# ============================================================================
14
15
# Name for the operator-managed MongoDB sharded cluster and MongoDBSearch resource
16
# (same name for both — operator infers the reference)
17
export MDB_RESOURCE_NAME="mdb-sh"
18
19
# ============================================================================
20
# OPS MANAGER / CLOUD MANAGER
21
# ============================================================================
22
23
export OPS_MANAGER_PROJECT_NAME="<arbitrary project name>"
24
export OPS_MANAGER_API_URL="<SET API URL>"
25
export OPS_MANAGER_API_USER="<SET API USER>"
26
export OPS_MANAGER_API_KEY="<SET API KEY>"
27
export OPS_MANAGER_ORG_ID="<SET ORG ID>"
28
29
# ============================================================================
30
# MONGODB VERSION
31
# ============================================================================
32
33
# Minimum required MongoDB version for Search is 8.2
34
export MDB_VERSION="8.3.4-ent"
35
36
# ============================================================================
37
# USER CREDENTIALS (change these in production!)
38
# ============================================================================
39
40
export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
41
export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
42
export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
43
44
# ============================================================================
45
# OPERATOR CONFIGURATION
46
# ============================================================================
47
48
export OPERATOR_HELM_CHART="oci://quay.io/mongodb/helm-charts/mongodb-kubernetes"
49
export OPERATOR_ADDITIONAL_HELM_VALUES=""
50
51
# ============================================================================
52
# TLS CONFIGURATION
53
# ============================================================================
54
55
export MDB_TLS_CERT_SECRET_PREFIX="certs"
56
export MDB_TLS_CA_CONFIGMAP="${MDB_RESOURCE_NAME}-ca"
57
58
export CERT_MANAGER_NAMESPACE="cert-manager"
59
export MDB_TLS_SELF_SIGNED_ISSUER="selfsigned-bootstrap-issuer"
60
export MDB_TLS_CA_CERT_NAME="my-selfsigned-ca"
61
export MDB_TLS_CA_SECRET_NAME="root-secret"
62
export MDB_TLS_CA_ISSUER="my-ca-issuer"
63
64
# ============================================================================
65
# SHARDED CLUSTER TOPOLOGY
66
# ============================================================================
67
68
export MDB_SHARD_COUNT=2
69
export MDB_MONGODS_PER_SHARD=1
70
export MDB_MONGOS_COUNT=1
71
export MDB_CONFIG_SERVER_COUNT=2
72
73
# Shard names (derived from operator naming convention)
74
export MDB_SHARD_0_NAME="${MDB_RESOURCE_NAME}-0"
75
export MDB_SHARD_1_NAME="${MDB_RESOURCE_NAME}-1"
76
77
# Mongos router endpoint (operator-managed)
78
export MDB_MONGOS_HOST="${MDB_RESOURCE_NAME}-mongos-0.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
79
80
# ============================================================================
81
# SEARCH CONFIGURATION
82
# ============================================================================
83
export MDB_MONGOT_REPLICAS=2
84
85
# ============================================================================
86
# DERIVED VALUES (computed from topology + search config above)
87
# ============================================================================
88
# Proxy service names (operator-derived, do not change)
89
export MDB_PROXY_SVC_SHARD_0="${MDB_RESOURCE_NAME}-search-0-${MDB_SHARD_0_NAME}-proxy-svc"
90
export MDB_PROXY_SVC_SHARD_1="${MDB_RESOURCE_NAME}-search-0-${MDB_SHARD_1_NAME}-proxy-svc"
91
92
# Connection strings (built from mongos host)
93
export MDB_ADMIN_CONNECTION_STRING="mongodb://mdb-admin:${MDB_ADMIN_USER_PASSWORD}@${MDB_MONGOS_HOST}/?tls=true&tlsCAFile=/tls/ca-pem&authSource=admin&authMechanism=SCRAM-SHA-256"
94
export MDB_USER_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_MONGOS_HOST}/?tls=true&tlsCAFile=/tls/ca-pem&authSource=admin&authMechanism=SCRAM-SHA-256"

1
echo "Validating environment variables..."
2
3
required_vars=(
4
  "K8S_CTX"
5
  "MDB_NS"
6
  "MDB_RESOURCE_NAME"
7
  "MDB_VERSION"
8
  "MDB_ADMIN_USER_PASSWORD"
9
  "MDB_USER_PASSWORD"
10
  "MDB_SEARCH_SYNC_USER_PASSWORD"
11
  "MDB_SHARD_COUNT"
12
  "MDB_SHARD_0_NAME"
13
  "MDB_SHARD_1_NAME"
14
  "MDB_MONGOS_HOST"
15
  "MDB_MONGOT_REPLICAS"
16
  "MDB_PROXY_SVC_SHARD_0"
17
  "MDB_PROXY_SVC_SHARD_1"
18
  "MDB_ADMIN_CONNECTION_STRING"
19
  "MDB_USER_CONNECTION_STRING"
20
)
21
22
missing_vars=()
23
for var in "${required_vars[@]}"; do
24
  [[ -n "${!var:-}" ]] && [[ "${!var}" != "<"* ]] || missing_vars+=("${var}")
25
done
26
27
if (( ${#missing_vars[@]} )); then
28
  echo "ERROR: Missing required environment variables:" >&2
29
  for m in "${missing_vars[@]}"; do echo "  - ${m}" >&2; done
30
  echo "Please edit env_variables.sh and set these values before proceeding." >&2
31
elif ! kubectl config get-contexts "${K8S_CTX}" &>/dev/null; then
32
  echo "ERROR: Kubernetes context '${K8S_CTX}' does not exist." >&2
33
  kubectl config get-contexts -o name
34
else
35
  echo "[ok] All required environment variables are set"
36
  echo "  Kubernetes context: ${K8S_CTX}"
37
  echo "  Namespace: ${MDB_NS}"
38
  echo "  Resource name: ${MDB_RESOURCE_NAME}"
39
  echo "  Shard count: ${MDB_SHARD_COUNT}"
40
  echo "  Shard 0: ${MDB_SHARD_0_NAME}"
41
  echo "  Shard 1: ${MDB_SHARD_1_NAME}"
42
  echo "  Mongos: ${MDB_MONGOS_HOST}"
43
  echo "  Mongot replicas: ${MDB_MONGOT_REPLICAS}"
44
fi

1
kubectl create namespace "${MDB_NS}" --context "${K8S_CTX}" --dry-run=client -o yaml | \
2
  kubectl apply --context "${K8S_CTX}" -f -
3
4
echo "[ok] Namespace '${MDB_NS}' ready"

1
helm upgrade --install --debug --kube-context "${K8S_CTX}" \
2
  --create-namespace --namespace="${MDB_NS}" \
3
  mongodb-kubernetes \
4
  ${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
5
  "${OPERATOR_HELM_CHART}"

1
echo "Creating Ops Manager connection resources..."
2
3
# Create the credentials secret with API key
4
kubectl create secret generic om-credentials \
5
  --from-literal="user=${OPS_MANAGER_API_USER}" \
6
  --from-literal="publicApiKey=${OPS_MANAGER_API_KEY}" \
7
  --namespace="${MDB_NS}" \
8
  --context "${K8S_CTX}" \
9
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
10
11
# Create the project ConfigMap
12
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
13
apiVersion: v1
14
kind: ConfigMap
15
metadata:
16
  name: om-project
17
data:
18
  baseUrl: "${OPS_MANAGER_API_URL}"
19
  orgId: "${OPS_MANAGER_ORG_ID}"
20
  projectName: "${OPS_MANAGER_PROJECT_NAME}"
21
EOF
22
23
echo "[ok] Ops Manager resources created"
24
echo "  - Secret: om-credentials"
25
echo "  - ConfigMap: om-project"

1
echo "Installing cert-manager..."
2
3
# Check if cert-manager is already installed
4
if kubectl get namespace "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" &>/dev/null \
5
  && kubectl get deployment cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" &>/dev/null; then
6
  echo "cert-manager is already installed, skipping installation"
7
  kubectl rollout status deployment/cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=60s
8
  echo "[ok] cert-manager is ready"
9
else
10
  kubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml \
11
    --context "${K8S_CTX}"
12
13
  echo "Waiting for cert-manager to be ready..."
14
  kubectl rollout status deployment/cert-manager -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
15
  kubectl rollout status deployment/cert-manager-webhook -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
16
  kubectl rollout status deployment/cert-manager-cainjector -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX}" --timeout=120s
17
18
  echo "[ok] cert-manager installed and ready"
19
fi

1
echo "Configuring TLS prerequisites..."
2
3
kubectl apply --context "${K8S_CTX}" -f - <<EOF
4
apiVersion: cert-manager.io/v1
5
kind: ClusterIssuer
6
metadata:
7
  name: ${MDB_TLS_SELF_SIGNED_ISSUER}
8
spec:
9
  selfSigned: {}
10
EOF
11
12
echo "  [ok] Self-signed ClusterIssuer created"
13
14
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
15
apiVersion: cert-manager.io/v1
16
kind: Certificate
17
metadata:
18
  name: ${MDB_TLS_CA_CERT_NAME}
19
spec:
20
  isCA: true
21
  commonName: mongodb-ca
22
  secretName: ${MDB_TLS_CA_SECRET_NAME}
23
  duration: 87600h  # 10 years
24
  renewBefore: 8760h  # 1 year
25
  privateKey:
26
    algorithm: ECDSA
27
    size: 256
28
  issuerRef:
29
    name: ${MDB_TLS_SELF_SIGNED_ISSUER}
30
    kind: ClusterIssuer
31
EOF
32
33
echo "  [ok] CA Certificate requested"
34
35
echo "  Waiting for CA certificate..."
36
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CA_CERT_NAME}" \
37
  -n "${CERT_MANAGER_NAMESPACE}" \
38
  --context "${K8S_CTX}" \
39
  --timeout=60s
40
41
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
42
apiVersion: cert-manager.io/v1
43
kind: ClusterIssuer
44
metadata:
45
  name: ${MDB_TLS_CA_ISSUER}
46
spec:
47
  ca:
48
    secretName: ${MDB_TLS_CA_SECRET_NAME}
49
EOF
50
51
echo "  [ok] CA Issuer created"
52
53
echo "[ok] TLS prerequisites configured"

1
echo "Configuring CA certificate (ConfigMap) for mongod..."
2
3
mkdir -p certs
4
5
kubectl get secret "${MDB_TLS_CA_SECRET_NAME}" \
6
  -n "${CERT_MANAGER_NAMESPACE}" \
7
  --context "${K8S_CTX}" \
8
  -o jsonpath='{.data.tls\.crt}' | base64 -d > certs/ca-pem
9
10
kubectl create configmap "${MDB_TLS_CA_CONFIGMAP}" \
11
  --from-file=ca-pem=certs/ca-pem \
12
  -n "${MDB_NS}" \
13
  --context "${K8S_CTX}" \
14
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
15
16
echo "[ok] CA ConfigMap configured for mongod"

1
echo "Configuring CA certificate (Secret) for mongot..."
2
3
mkdir -p certs
4
5
kubectl get secret "${MDB_TLS_CA_SECRET_NAME}" \
6
  -n "${CERT_MANAGER_NAMESPACE}" \
7
  --context "${K8S_CTX}" \
8
  -o jsonpath='{.data.tls\.crt}' | base64 -d > certs/ca.crt
9
10
kubectl create secret generic "${MDB_TLS_CA_SECRET_NAME}" \
11
  --from-file=ca.crt=certs/ca.crt \
12
  -n "${MDB_NS}" \
13
  --context "${K8S_CTX}" \
14
  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" -f -
15
16
echo "[ok] CA Secret configured for mongot"

1
echo "Generating TLS certificates for MongoDB..."
2
3
# --- Shard 0 ---
4
echo "Creating certificate for shard ${MDB_RESOURCE_NAME}-0..."
5
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
6
apiVersion: cert-manager.io/v1
7
kind: Certificate
8
metadata:
9
  name: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-0-cert
10
spec:
11
  secretName: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-0-cert
12
  duration: 8760h    # 1 year
13
  renewBefore: 720h  # 30 days
14
  privateKey:
15
    algorithm: RSA
16
    size: 2048
17
  usages:
18
    - server auth
19
    - client auth
20
  dnsNames:
21
    - "*.${MDB_RESOURCE_NAME}-sh.${MDB_NS}.svc.cluster.local"
22
  issuerRef:
23
    name: ${MDB_TLS_CA_ISSUER}
24
    kind: ClusterIssuer
25
EOF
26
echo "  [ok] Certificate requested for shard ${MDB_RESOURCE_NAME}-0"
27
28
# --- Shard 1 ---
29
echo "Creating certificate for shard ${MDB_RESOURCE_NAME}-1..."
30
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
31
apiVersion: cert-manager.io/v1
32
kind: Certificate
33
metadata:
34
  name: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-1-cert
35
spec:
36
  secretName: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-1-cert
37
  duration: 8760h    # 1 year
38
  renewBefore: 720h  # 30 days
39
  privateKey:
40
    algorithm: RSA
41
    size: 2048
42
  usages:
43
    - server auth
44
    - client auth
45
  dnsNames:
46
    - "*.${MDB_RESOURCE_NAME}-sh.${MDB_NS}.svc.cluster.local"
47
  issuerRef:
48
    name: ${MDB_TLS_CA_ISSUER}
49
    kind: ClusterIssuer
50
EOF
51
echo "  [ok] Certificate requested for shard ${MDB_RESOURCE_NAME}-1"
52
53
# --- Config servers ---
54
echo "Creating config server certificate..."
55
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
56
apiVersion: cert-manager.io/v1
57
kind: Certificate
58
metadata:
59
  name: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-config-cert
60
spec:
61
  secretName: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-config-cert
62
  duration: 8760h    # 1 year
63
  renewBefore: 720h  # 30 days
64
  privateKey:
65
    algorithm: RSA
66
    size: 2048
67
  usages:
68
    - server auth
69
    - client auth
70
  dnsNames:
71
    - "*.${MDB_RESOURCE_NAME}-cs.${MDB_NS}.svc.cluster.local"
72
  issuerRef:
73
    name: ${MDB_TLS_CA_ISSUER}
74
    kind: ClusterIssuer
75
EOF
76
echo "  [ok] Certificate requested for config servers"
77
78
# --- Mongos ---
79
echo "Creating mongos certificate..."
80
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
81
apiVersion: cert-manager.io/v1
82
kind: Certificate
83
metadata:
84
  name: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-mongos-cert
85
spec:
86
  secretName: ${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-mongos-cert
87
  duration: 8760h    # 1 year
88
  renewBefore: 720h  # 30 days
89
  privateKey:
90
    algorithm: RSA
91
    size: 2048
92
  usages:
93
    - server auth
94
    - client auth
95
  dnsNames:
96
    - "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
97
    - "${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
98
  issuerRef:
99
    name: ${MDB_TLS_CA_ISSUER}
100
    kind: ClusterIssuer
101
EOF
102
echo "  [ok] Certificate requested for mongos"
103
104
# Wait for all certificates
105
echo ""
106
echo "Waiting for all certificates to be ready..."
107
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-0-cert" -n "${MDB_NS}" --context "${K8S_CTX}" --timeout=60s
108
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-1-cert" -n "${MDB_NS}" --context "${K8S_CTX}" --timeout=60s
109
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-config-cert" -n "${MDB_NS}" --context "${K8S_CTX}" --timeout=60s
110
kubectl wait --for=condition=Ready certificate/"${MDB_TLS_CERT_SECRET_PREFIX}-${MDB_RESOURCE_NAME}-mongos-cert" -n "${MDB_NS}" --context "${K8S_CTX}" --timeout=60s
111
112
echo "[ok] All MongoDB TLS certificates created"

1
helm upgrade --install \
2
  cert-manager \
3
  oci://quay.io/jetstack/charts/cert-manager \
4
  --kube-context "${K8S_CTX}" \
5
  --namespace "${CERT_MANAGER_NAMESPACE}" \
6
  --create-namespace \
7
  --set crds.enabled=true
8
9
for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do
10
  kubectl --context "${K8S_CTX}" \
11
    -n "${CERT_MANAGER_NAMESPACE}" \
12
    wait --for=condition=Available "deployment/${deployment}" --timeout=300s
13
done
14
15
echo "cert-manager is ready in namespace ${CERT_MANAGER_NAMESPACE}."

1
# 1. Self-signed bootstrap issuer
2
kubectl apply --context "${K8S_CTX}" -f - <<EOF
3
apiVersion: cert-manager.io/v1
4
kind: ClusterIssuer
5
metadata:
6
  name: ${MDB_TLS_SELF_SIGNED_ISSUER}
7
spec:
8
  selfSigned: {}
9
EOF
10
kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_SELF_SIGNED_ISSUER}" --timeout=120s
11
12
# 2. CA certificate
13
kubectl apply --context "${K8S_CTX}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOF
14
apiVersion: cert-manager.io/v1
15
kind: Certificate
16
metadata:
17
  name: ${MDB_TLS_CA_CERT_NAME}
18
  namespace: ${CERT_MANAGER_NAMESPACE}
19
spec:
20
  isCA: true
21
  commonName: ${MDB_TLS_CA_CERT_NAME}
22
  secretName: ${MDB_TLS_CA_SECRET_NAME}
23
  privateKey:
24
    algorithm: ECDSA
25
    size: 256
26
  issuerRef:
27
    name: ${MDB_TLS_SELF_SIGNED_ISSUER}
28
    kind: ClusterIssuer
29
EOF
30
kubectl --context "${K8S_CTX}" wait --for=condition=Ready -n "${CERT_MANAGER_NAMESPACE}" certificate "${MDB_TLS_CA_CERT_NAME}" --timeout=300s
31
32
# 3. CA issuer referencing CA secret
33
kubectl apply --context "${K8S_CTX}" -f - <<EOF
34
apiVersion: cert-manager.io/v1
35
kind: ClusterIssuer
36
metadata:
37
  name: ${MDB_TLS_CA_ISSUER}
38
spec:
39
  ca:
40
    secretName: ${MDB_TLS_CA_SECRET_NAME}
41
EOF
42
kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_CA_ISSUER}" --timeout=120s
43
44
# 4. Extract CA cert (only ca.crt) and publish to ConfigMap
45
TMP_CA_CERT="$(mktemp)"; trap 'rm -f "${TMP_CA_CERT}"' EXIT
46
ca_b64="$(kubectl --context "${K8S_CTX}" get secret "${MDB_TLS_CA_SECRET_NAME}" -n "${CERT_MANAGER_NAMESPACE}" -o jsonpath="{.data['ca\\.crt']}")"
47
[[ -n "${ca_b64}" ]] || { echo "CA certificate key ca.crt missing in secret ${MDB_TLS_CA_SECRET_NAME}" >&2; exit 1; }
48
printf '%s' "${ca_b64}" | base64 --decode > "${TMP_CA_CERT}"
49
50
# Create ConfigMap containing CA (used by both MongoDBCommunity and external search source)
51
kubectl --context "${K8S_CTX}" create configmap "${MDB_TLS_CA_CONFIGMAP}" -n "${MDB_NS}" \
52
  --from-file=ca-pem="${TMP_CA_CERT}" --from-file=mms-ca.crt="${TMP_CA_CERT}" --from-file=ca.crt="${TMP_CA_CERT}" \
53
  --dry-run=client -o yaml | kubectl --context "${K8S_CTX}" apply -f -
54
55
echo "CA issuer and artifacts prepared (ConfigMap: ${MDB_TLS_CA_CONFIGMAP})."

1
# Issue server and search certificates
2
server_certificate="${MDB_RESOURCE_NAME}-server-tls"
3
search_certificate="${MDB_RESOURCE_NAME}-search-tls"
4
5
# DNS names for MongoDB server certificate
6
mongo_dns_names=()
7
[[ -n "${MDB_EXTERNAL_HOST_0:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_0%%:*}")
8
[[ -n "${MDB_EXTERNAL_HOST_1:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_1%%:*}")
9
[[ -n "${MDB_EXTERNAL_HOST_2:-}" ]] && mongo_dns_names+=("${MDB_EXTERNAL_HOST_2%%:*}")
10
mongo_dns_names+=("${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local" "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local")
11
[[ ${#mongo_dns_names[@]} -gt 0 ]] || { echo "No MongoDB DNS names generated; set MDB_EXTERNAL_HOST_* vars" >&2; exit 1; }
12
13
# DNS names for MongoDB Search certificate
14
search_dns_names=(
15
  "*.${MDB_SEARCH_SERVICE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
16
  "${MDB_SEARCH_SERVICE_NAME}-search-0-proxy-svc.${MDB_NS}.svc.cluster.local"
17
)
18
[[ -n "${MDB_SEARCH_HOSTNAME}" ]] && search_dns_names+=("${MDB_SEARCH_HOSTNAME}")
19
20
mongo_dns_block="$(printf '      - "%s"\n' "${mongo_dns_names[@]}")"
21
search_dns_block="$(printf '      - "%s"\n' "${search_dns_names[@]}")"
22
23
kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
24
apiVersion: cert-manager.io/v1
25
kind: Certificate
26
metadata:
27
  name: ${server_certificate}
28
  namespace: ${MDB_NS}
29
spec:
30
  secretName: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
31
  issuerRef:
32
    name: ${MDB_TLS_CA_ISSUER}
33
    kind: ClusterIssuer
34
  duration: 240h0m0s
35
  renewBefore: 120h0m0s
36
  usages:
37
    - digital signature
38
    - key encipherment
39
    - server auth
40
    - client auth
41
  dnsNames:
42
${mongo_dns_block}
43
---
44
apiVersion: cert-manager.io/v1
45
kind: Certificate
46
metadata:
47
  name: ${search_certificate}
48
  namespace: ${MDB_NS}
49
spec:
50
  secretName: ${MDB_SEARCH_TLS_SECRET_NAME}
51
  issuerRef:
52
    name: ${MDB_TLS_CA_ISSUER}
53
    kind: ClusterIssuer
54
  duration: 240h0m0s
55
  renewBefore: 120h0m0s
56
  usages:
57
    - digital signature
58
    - key encipherment
59
    - server auth
60
    - client auth
61
  dnsNames:
62
${search_dns_block}
63
EOF
64
65
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${server_certificate}" --timeout=300s
66
kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${search_certificate}" --timeout=300s
67
68
echo "Server and Search TLS certificates issued (Secrets: ${MDB_TLS_SERVER_CERT_SECRET_NAME}, ${MDB_SEARCH_TLS_SECRET_NAME})."

1
# ============================================================================
2
# KUBERNETES CONFIGURATION
3
# ============================================================================
4
5
# Your Kubernetes context name (run: kubectl config get-contexts)
6
export K8S_CTX="<local cluster context>"
7
8
# Namespace where MongoDB Search will be deployed
9
export MDB_NS="mongodb"
10
11
# ============================================================================
12
# CLUSTER NAMING
13
# ============================================================================
14
15
# Name for the external MongoDB replica set
16
export MDB_EXTERNAL_CLUSTER_NAME="ext-mdb-rs"
17
18
# MongoDB Search resource name (different from MDB name since it's "external")
19
export MDB_SEARCH_RESOURCE_NAME="ext-rs"
20
21
# ============================================================================
22
# REPLICA SET CONFIGURATION
23
# ============================================================================
24
25
# Number of replica set members
26
export MDB_RS_MEMBERS=3
27
28
# Number of mongot replicas (for high availability)
29
# The operator deploys this many mongot pods, all fronted by Envoy
30
export MDB_MONGOT_REPLICAS=2
31
32
# ============================================================================
33
# OPS MANAGER / CLOUD MANAGER
34
# ============================================================================
35
36
export OPS_MANAGER_PROJECT_NAME="<arbitrary project name>"
37
export OPS_MANAGER_API_URL="<SET API URL>"
38
export OPS_MANAGER_API_USER="<SET API USER>"
39
export OPS_MANAGER_API_KEY="<SET API KEY>"
40
export OPS_MANAGER_ORG_ID="<SET ORG ID>"
41
42
# ============================================================================
43
# MONGODB VERSION
44
# ============================================================================
45
46
# Minimum required MongoDB version for Search is 8.2
47
export MDB_VERSION="8.3.4-ent"
48
49
# ============================================================================
50
# USER CREDENTIALS (change these in production!)
51
# ============================================================================
52
53
export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
54
export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
55
export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
56
57
# ============================================================================
58
# OPERATOR CONFIGURATION
59
# ============================================================================
60
61
export OPERATOR_HELM_CHART="oci://quay.io/mongodb/helm-charts/mongodb-kubernetes"
62
export OPERATOR_ADDITIONAL_HELM_VALUES=""
63
64
# ============================================================================
65
# TLS CONFIGURATION
66
# ============================================================================
67
68
export MDB_TLS_ENABLED="true"
69
export MDB_TLS_CERT_SECRET_PREFIX="certs"
70
export MDB_TLS_CA_CONFIGMAP="${MDB_EXTERNAL_CLUSTER_NAME}-ca"
71
72
export CERT_MANAGER_NAMESPACE="cert-manager"
73
export MDB_TLS_SELF_SIGNED_ISSUER="selfsigned-bootstrap-issuer"
74
export MDB_TLS_CA_CERT_NAME="my-selfsigned-ca"
75
export MDB_TLS_CA_SECRET_NAME="root-secret"
76
export MDB_TLS_CA_ISSUER="my-ca-issuer"
77
78
# ============================================================================
79
# EXTERNAL CLUSTER RESOURCE NAMES
80
# ============================================================================
81
# These names identify the components of the external MongoDB replica set.
82
# Default values match the Kubernetes operator naming convention.
83
# Override them when pointing at a real external cluster.
84
85
# External RS member host:port entries
86
export MDB_EXTERNAL_HOST_0="${MDB_EXTERNAL_CLUSTER_NAME}-0.${MDB_EXTERNAL_CLUSTER_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
87
export MDB_EXTERNAL_HOST_1="${MDB_EXTERNAL_CLUSTER_NAME}-1.${MDB_EXTERNAL_CLUSTER_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
88
export MDB_EXTERNAL_HOST_2="${MDB_EXTERNAL_CLUSTER_NAME}-2.${MDB_EXTERNAL_CLUSTER_NAME}-svc.${MDB_NS}.svc.cluster.local:27017"
89
90
# ============================================================================
91
# ENVOY PROXY CONFIGURATION (Managed by Operator)
92
# ============================================================================
93
94
# Port where Envoy listens for mongod connections (operator default)
95
export ENVOY_PROXY_PORT="27028"
96
97
# Managed LB proxy host -- stable proxy service for the RS topology
98
export MDB_PROXY_HOST="${MDB_SEARCH_RESOURCE_NAME}-search-0-proxy-svc.${MDB_NS}.svc.cluster.local:${ENVOY_PROXY_PORT}"
99
100
# NOTE: Unlike unmanaged mode, you do NOT need to specify:
101
# - ENVOY_IMAGE (operator uses its default)
102
# - Envoy ConfigMap or Deployment YAML
103
# - Proxy Services
104
# The operator handles all of this automatically!
105
106
# ============================================================================
107
# CONNECTION STRING
108
# ============================================================================
109
110
# Connection string for the replica set with TLS
111
export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_EXTERNAL_HOST_0},${MDB_EXTERNAL_HOST_1},${MDB_EXTERNAL_HOST_2}/?replicaSet=${MDB_EXTERNAL_CLUSTER_NAME}&tls=true&tlsCAFile=/tls/ca-pem"