Deploy an Ops Manager Resource¶

Configure kubectl to default to your namespace.¶

If you have not already, run the following command to execute all kubectl commands in the namespace you created.

kubectl config set-context $(kubectl config current-context) --namespace=<metadata.namespace>

Create secrets for your certificates.¶

If you’re using HashiCorp Vault as your secret storage tool, you can Create a Vault Secret instead.

To learn about your options for secret storage, see Configure Secret Storage.

1. Once you have your TLS certificates and private keys, run the following command to create a secret that stores Ops Manager’s TLS certificate:

   copy

   kubectl create secret tls <prefix>-<metadata.name>-cert \
     --cert=<om-tls-cert> \
     --key=<om-tls-key>
   

2. Run the following command to create a new secret that stores the application database’s TLS certificate:

   copy

   kubectl create secret tls <prefix>-<metadata.name>-db-cert \
     --cert=<appdb-tls-cert> \
     --key=<appdb-tls-key>
   

If necessary, validate your TLS certificates.¶

If your Ops Manager TLS certificate or your application database TLS certificate is signed by a Custom Certificate Authority, you must provide a CA certificate to validate the TLS certificate(s). To validate the TLS certificate(s), create a ConfigMap to hold the CA certificate:

1. Obtain the entire TLS certificate chain for both Ops Manager and the application database from downloads.mongodb.com. The following openssl command outputs each certificate in the chain to your current working directory, in .crt format:

   copy

   openssl s_client -showcerts -verify 2 \
   -connect downloads.mongodb.com:443 -servername downloads.mongodb.com < /dev/null \
   | awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="cert"a".crt"; print >out}'
   

2. Concatenate your CA’s certificate file for Ops Manager with the entire TLS certificate chain from downloads.mongodb.com that you obtained in the previous step:

   copy

   cat cert1.crt cert2.crt cert3.crt cert4.crt  >> mms-ca.crt
   

3. Concatenate your CA’s certificate file for the application database with the entire TLS certificate chain from downloads.mongodb.com that you obtained in the previous step:

   copy

   cat cert1.crt cert2.crt cert3.crt cert4.crt  >> ca-pem
   

4. Create the ConfigMap for Ops Manager:

   copy

   kubectl create configmap om-http-cert-ca --from-file="mms-ca.crt"
   

5. Create the ConfigMap for the application database:

   copy

   kubectl create configmap ca --from-file="ca-pem"
   

Copy the following example Ops Manager Kubernetes object.¶

Change the highlighted settings to match your desired Ops Manager and application database configuration.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

---
apiVersion: mongodb.com/v1
kind: MongoDBOpsManager
metadata:
  name: <myopsmanager>
spec:
  replicas: 1
  version: <opsmanagerversion>
  adminCredentials: <adminusercredentials> # Should match metadata.name
                                           # in the Kubernetes secret
                                           # for the admin user

  externalConnectivity:
    type: LoadBalancer
  security:
      certsSecretPrefix: <prefix> # Required. Text to prefix 
                                  # the name of the secret that contains
                                  # Ops Manager's TLS certificate.
      tls:
        ca: "om-http-cert-ca"  # Optional. Name of the ConfigMap file
                               # containing the certificate authority that
                               # signs the certificates used by the Ops
                               # Manager custom resource.

  applicationDatabase:
    members: 3
    version: "4.4.0-ubi8"
    security:
      certsSecretPrefix: <prefix> # Required. Text to prefix to the 
                                  # name of the secret that contains the Application
                                  # Database's TLS certificate. Name the secret 
                                  # <prefix>-<metadata.name>-db-cert.
      tls:
        ca: "appdb-ca" # Optional. Name of the ConfigMap file
                       # containing the certicate authority that
                       # signs the certificates used by the
                       # application database.

...

Open your preferred text editor and paste the object specification into a new text file.¶

Configure the settings highlighted in the prior example.¶

Optional: Configure Backup settings¶

If you want to enable backup for your Ops Manager instance, you must configure all of the following settings:

You must also configure an S3 snapshot store or a blockstore.

To configure a snapshot store, configure the following settings:

To configure a blockstore, configure the following settings:

Optional: Configure any additional settings for an Ops Manager backup.¶

Add any optional settings for backups that you want to apply to your deployment to the object specification file. For example, for each type of backup store, and for Ops Manager backup daemon processes, you can assign labels to associate particular backup stores or backup daemon processes with specific projects. Use spec.backup.[*].assignmentLabels elements of the OpsManager resources.

Optional: Configure any additional settings for an Ops Manager deployment.¶

Add any optional settings that you want to apply to your deployment to the object specification file.

Save this file with a .yaml file extension.¶

Create your Ops Manager instance.¶

Run the following kubectl command on the filename of the Ops Manager resource definition:

kubectl apply -f <opsmgr-resource>.yaml

kubectl apply \
  --context "$MDB_CENTRAL_CLUSTER_FULL_NAME" \
  --namespace "mongodb"
   -f https://raw.githubusercontent.com/mongodb/mongodb-enterprise-kubernetes/master/samples/ops-manager/ops-manager-external.yaml

Track the status of your Ops Manager instance.¶

To check the status of your Ops Manager resource, invoke the following command:

kubectl get om -o yaml -w

The command returns the following output under the status field while the resource deploys:

status:
 applicationDatabase:
  lastTransition: "2020-04-01T09:49:22Z"
  message: AppDB Statefulset is not ready yet
  phase: Reconciling
  type: ""
  version: ""
 backup:
  phase: ""
 opsManager:
  phase: ""

The Kubernetes Operator reconciles the resources in the following order:

1. Application Database.
2. Ops Manager.
3. Backup.

The Kubernetes Operator doesn’t reconcile a resource until the preceding one enters the Running phase.

After the Ops Manager resource completes the Reconciling phase, the command returns the following output under the status field if you enabled backup:

 status:
   applicationDatabase:
     lastTransition: "2020-04-01T09:50:20Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
  backup:
   lastTransition: "2020-04-01T09:57:42Z"
   message: The MongoDB object <namespace>/<oplogresourcename>
     doesn't exist
   phase: Pending
   opsManager:
     lastTransition: "2020-04-01T09:57:40Z"
     phase: Running
     replicas: 1
     url: https://om-svc.cloudqa.svc.cluster.local:8443
     version: "5.0.0"

Backup remains in a Pending state until you configure the backup databases.

After the resource completes the Reconciling phase, the command returns the following output under the status field:

 status:
   applicationDatabase:
     lastTransition: "2019-12-06T18:23:22Z"
     members: 3
     phase: Running
     type: ReplicaSet
     version: "4.4.5-ubi8"
   opsManager:
     lastTransition: "2019-12-06T18:23:26Z"
     message: The MongoDB object namespace/oplogdbname doesn't exist
     phase: Pending
     url: https://om-svc.dev.svc.cluster.local:8443
     version: ""

Backup remains in a Pending state until you configure the backup databases.

Access the Ops Manager application.¶

The steps you take differ based on how you are routing traffic to the Ops Manager application in Kubernetes. If you configured the Kubernetes Operator to create a Kubernetes service for you, or you created a Kubernetes service manually, use one of the following methods to access the Ops Manager application:

To learn how to access the Ops Manager application using a third-party service, refer to the documentation for your solution.

Create credentials for the Kubernetes Operator.¶

To configure credentials, you must create an Ops Manager organization, generate programmatic API keys, and create a secret. These activities follow the prerequisites and procedure on the Create Credentials for the Kubernetes Operator page.

Create a project using a ConfigMap.¶

To create a project, follow the prerequisites and procedure on the Create One Project using a ConfigMap page.

Set the following fields in your project ConfigMap:

• Set data.baseUrl in the ConfigMap to the Ops Manager Application’s URL. To find this URL, invoke the following command:

  
  
  copy

  kubectl get om -o yaml -w
  

  
  

  The command returns the URL of the Ops Manager Application in the status.opsManager.url field.

  
  
    status:
      applicationDatabase:
        lastTransition: "2019-12-06T18:23:22Z"
        members: 3
        phase: Running
        type: ReplicaSet
        version: "4.4.5-ubi8"
      opsManager:
        lastTransition: "2019-12-06T18:23:26Z"
        message: The MongoDB object namespace/oplogdbname doesn't exist
        phase: Pending
        url: https://om-svc.dev.svc.cluster.local:8443
        version: ""
  

  Important

  If you deploy Ops Manager with the Kubernetes Operator and Ops Manager will manage MongoDB database resources deployed outside of the Kubernetes cluster it’s deployed to, you must set data.baseUrl to the same value of the spec.configuration.mms.centralUrl setting in the Ops Manager resource specification.

  See also

  Managing External MongoDB Deployments

• Set data.sslMMSCAConfigMap to the name of your ConfigMap containing the root CA certificate used to sign the Ops Manager host’s certificate. The Kubernetes Operator requires this name to be mms-ca.crt.

Deploy MongoDB database resources to complete the backup configuration.¶

By default, Ops Manager enables Backup. Create a MongoDB database resource for the oplog and snapshot stores to complete the configuration.

1. Deploy a MongoDB database resource for the oplog store in the same namespace as the Ops Manager resource.

   Note

   Create this database as a three-member replica set.

   Match the metadata.name of the resource with the spec.backup.opLogStores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

2. Deploy a MongoDB database resource for the S3 snapshot store in the same namespace as the Ops Manager resource.

   Note

   Create the S3 snapshot store as a replica set.

   Match the metadata.name of the resource to the spec.backup.s3Stores.mongodbResourceRef.name that you specified in your Ops Manager resource definition.

Confirm that the Ops Manager resource is running.¶

To check the status of your Ops Manager resource, invoke the following command:

kubectl get om -o yaml -w

When Ops Manager is running, the command returns the following output under the status field:

status:
  applicationDatabase:
    lastTransition: "2019-12-06T17:46:15Z"
    members: 3
    phase: Running
    type: ReplicaSet
    version: "4.4.5-ubi8"
  opsManager:
    lastTransition: "2019-12-06T17:46:32Z"
    phase: Running
    replicas: 1
    url: https://om-backup-svc.dev.svc.cluster.local:8443
    version: "5.0.0"

See Troubleshoot the Kubernetes Operator for information about the resource deployment statuses.