Configure KMIP Backup Encryption for Ops Manager¶

Create the ConfigMap of the CA.¶

Run the following command:

kubectl -n mongodb create configmap mongodb-kmip-certificate-authority-pem --from-file=ca-pem

Configure the Ops Manager custom resource to use KMIP backup encryption.¶

Configure the spec.backup.encryption.kmip settings.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

  apiVersion: mongodb.com/v1
  kind: MongoDBOpsManager
  metadata:
    name: om-backup-kmip
  spec:
    replicas: 1
    version: 6.0.0
    adminCredentials: ops-manager-admin-secret
    backup:
      encryption:
        kmip:
          server:
            url: kmip.corp.mongodb.com:5696
            ca: mongodb-kmip-certificate-authority-pem

Save your Ops Manager config file.¶

Apply changes to your Ops Manager deployment.¶

Invoke the following kubectl command on the filename of the Ops Manager resource definition:

kubectl apply -f <opsmgr-resource>.yaml

Check the status of your Ops Manager resources.¶

Run the following command:

kubectl get om <resource-name> -o yaml -w

Create the secret of the client certificate and private key.¶

Run the following command:

kubectl -n mongodb create secret tls mongodb-kmip-client-pem-my-replica-set-client-kmip \
--cert=<path-to-cert-file> \
--key=<path-to-key-file>

The client certificate secret name has the following naming convention inferred from the MongoDB CustomResourceDefinition:

<clientCertificatePrefix>-<objectMeta.name>-client-kmip

To learn more, see kubernetes.io/tls.

Configure your MongoDB database deployment.¶

Configure the spec.backup.encryption.kmip settings.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

  apiVersion: mongodb.com/v1
  kind: MongoDB
  metadata:
    name: my-replica-set
  spec:
    members: 3
    version: 4.0.20
    type: ReplicaSet
    backup:
      encryption:
        kmip:
          client:
            clientCertificatePrefix: mongodb-kmip-client-pem

To learn more, see deploy a replica set or deploy a sharded cluster.

Save your MongoDB database deployment config file.¶

Apply changes to your MongoDB database deployment.¶

Invoke the following kubectl command on the filename of the Ops Manager resource definition:

kubectl apply -f <mdb-database-deployment>.yaml

Check the status of your MongoDB database deployment.¶

Run the following command:

kubectl get mdb <resource-name> -o yaml -w