Connect to a MongoDB Database Resource from Outside Kubernetes¶

Deploy a replica set with the Kubernetes Operator.¶

If you haven’t deployed a replica set, follow the instructions to deploy one.

You must enable TLS for the replica set by providing a value for the spec.security.certsSecretPrefix setting. The replica set must use a custom CA certificate stored with spec.security.tls.ca.

Configure services to ensure connectivity.¶

1. Paste the following example services into a text editor:

   copy

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43

   --- kind: Service apiVersion: v1 metadata: name: my-external-0 spec: ports: - name: mongodb protocol: TCP port: 443 targetPort: 27017 selector: statefulset.kubernetes.io/pod-name: my-external-0 --- kind: Service apiVersion: v1 metadata: name: my-external-1 spec: ports: - name: mongodb protocol: TCP port: 443 targetPort: 27017 selector: statefulset.kubernetes.io/pod-name: my-external-1 --- kind: Service apiVersion: v1 metadata: name: my-external-2 spec: ports: - name: mongodb protocol: TCP port: 443 targetPort: 27017 selector: statefulset.kubernetes.io/pod-name: my-external-2 ...

   Note

   If the spec.selector has entries that target headless services or applications, OpenShift may create a software firewall rule explicitly dropping connectivity. Review the selectors carefully and consider targeting the stateful set pod members directly as seen in the example. Routes in OpenShift offer port 80 or port 443. This example service uses port 443.

2. Change the settings to your preferred values.

3. Save this file with a .yaml file extension.

4. To create the services, invoke the following kubectl command on the services file you created:

   copy

   kubectl apply -f <my-external-services>.yaml
   

Configure routes to ensure TLS terminination passthrough.¶

1. Paste the following example routes into a text editor:

   copy

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

   --- apiVersion: v1 kind: Route metadata: name: my-external-0 spec: host: my-external-0.{redacted} to: kind: Service name: my-external-0 tls: termination: passthrough --- apiVersion: v1 kind: Route metadata: name: my-external-1 spec: host: my-external-1.{redacted} to: kind: Service name: my-external-1 tls: termination: passthrough --- apiVersion: v1 kind: Route metadata: name: my-external-2 spec: host: my-external-2.{redacted} to: kind: Service name: my-external-2 tls: termination: passthrough ...

   Note

   To ensure the TLS SNI negotiation with mongod necessary for mongod to respond with the correct horizon replica set topology for the drivers to use, you must set TLS termination passthrough.

2. Change the settings to your preferred values.

3. Save this file with a .yaml file extension.

4. To create the routes, invoke the following kubectl command on the routes file you created:

   copy

   kubectl apply -f <my-external-routes>.yaml
   

Add Subject Alternate Names to your TLS certificates.¶

Add each external DNS name to the certificate SAN.

Open your replica set resource YAML file.¶

Configure your replica set resource YAML file.¶

Use the following example to edit your replica set resource YAML file:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

---
apiVersion: mongodb.com/v1
kind: MongoDB
metadata:
  name: my-external
  namespace: mongodb
spec:
  type: ReplicaSet
  members: 3
  version: 4.2.2-ent
  opsManager:
    configMapRef:
      name: {redacted}
  credentials: {redacted}
  persistent: false
  security:
    tls:
      # TLS must be enabled to allow external connectivity
      enabled: true
    authentication:
      enabled: true
      modes: ["SCRAM","X509"]
  connectivity:
    # The "localhost" routes are included to enable the creation of localhost
    # TLS SAN in the CSR, per OpenShift route requirements.
    # "ocroute" is the configured route in OpenShift.
    replicaSetHorizons:
      - "ocroute": "my-external-0.{redacted}:443"
        "localhost": "localhost:27017"
      - "ocroute": "my-external-1.{redacted}:443"
        "localhost": "localhost:27018"
      - "ocroute": "my-external-2.{redacted}:443"
        "localhost": "localhost:27019"

...

Change the settings to your preferred values.¶

Save your replica set config file.¶

Create the necessary TLS certificates and Kubernetes secrets.¶

Configure TLS for your replica set. Create one secret for the MongoDB replica set and one for the certificate authority. The Kubernetes Operator uses these secrets to place the TLS files in the pods for MongoDB to use.

Update and restart your replica set deployment.¶

In any directory, invoke the following Kubernetes command to update and restart your replica set:

kubectl apply -f <replica-set-conf>.yaml

Test the connection to the replica set.¶

The Kubernetes Operator should deploy the MongoDB replica set, configured with the horizon routes created for ingress. After the Kubernetes Operator completes the deployment, you may connect with the horizon using TLS connectivity. If the certificate authority is not present on your workstation, you can view and copy it from a MongoDB pod using the following command:

oc exec -it my-external-0 -- cat /mongodb-automation/ca.pem

To test the connections, run the following command:

mongosh --host my-external/my-external-0.{redacted} \
      --port 443
      --ssl \
      --tlsAllowInvalidCertificates

In production, for each host in a replica set, specify the TLS certificate and the CA to securely connect to client tools or applications:

mongosh --host my-external/my-external-0.{redacted} \
  --port 443 \
  --tls \
  --tlsCertificateKeyFile server.pem \
  --tlsCAFile ca-pem

If the connection succeeds, you should see:

Enterprise <my-replica-set> [primary]