> For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt # Create One Project Per MongoDB Deployment Using a ConfigMap The MongoDB Controllers for Kubernetes Operator uses a Kubernetes [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) to link to a single and unique Ops Manager [Project](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-projects/). If the referenced project doesn't exist, the Kubernetes Operator creates it according to the `projectName` that you provide in the ConfigMap. To create a Kubernetes Operator ConfigMap, you can edit a few lines of the [example ConfigMap](https://www.mongodb.com/docs/kubernetes/current/tutorial/create-project-using-configmap.md#std-label-example-k8s-configmap) YAML (Yet Another Markup Language) file and apply the ConfigMap. To view a full example, see the [project.yaml](https://github.com//mongodb/mongodb-kubernetes/blob/1.14.0/public/samples/mongodb/project.yaml) file. Alternatively, you can use the MongoDB Cloud Manager [UI](https://www.mongodb.com/docs/cloud-manager/tutorial/nav/k8s-config-for-mdb-resource/) or the Ops Manager [UI](https://www.mongodb.com/docs/ops-manager/current/tutorial/nav/k8s-config-for-mdb-resource/) to create or choose a project, and automatically generate the ConfigMap YAML file, which you can then apply to your Kubernetes environment. ## Considerations 1. You can deploy only one MongoDB resource per project. This limit applies because Ops Manager supports only one authentication method for database user access per project. To learn more, see [Deploy a MongoDB Database Resource.](https://www.mongodb.com/docs/kubernetes/current/deploy.md#std-label-k8s-deploy-mdb-resources) 2. You must pair a MongoDB Controllers for Kubernetes Operator deployment to a unique Ops Manager [Project](https://www.mongodb.com/docs/ops-manager/current/tutorial/manage-projects/). You can either create a distinct ConfigMap for each MongoDB Controllers for Kubernetes Operator instance you deploy, or you can reuse the same ConfigMap for any number of deployments by omitting the `data.projectName` from your ConfigMap, so that project names align with deployed resource names. Where a project name is provided in the config map, if that project does not exist yet it will be created. **Important:** - You can use the Kubernetes Operator to deploy MongoDB resources with Cloud Manager and with Ops Manager version 6.0.x or later. - You can use the [Atlas Operator](https://www.mongodb.com/docs/atlas/reference/atlas-operator/ak8so-quick-start/) to deploy MongoDB resources to Atlas. ## Prerequisites - Kubernetes version 1.11 or later or Openshift version 3.11 or later. - MongoDB Controllers for Kubernetes Operator [installed.](https://www.mongodb.com/docs/kubernetes/current/tutorial/install-k8s-operator.md) ## Create One Project Using a ConfigMap 1. Configure `kubectl` to default to your namespace. If you have not already, run the following command to execute all `kubectl` commands in the namespace you [created.](https://www.mongodb.com/docs/kubernetes/current/tutorial/plan-k8s-op-prerequisites.md#std-label-k8s-prerequisites) **Note:** If you are deploying an Ops Manager resource in a multi-Kubernetes cluster MongoDB deployment: - Set the `context` to the name of the [central cluster](https://www.mongodb.com/docs/kubernetes/current/multi-cluster-overview.md#std-label-central-and-member-clusters), such as: `kubectl config set context "$MDB_CENTRAL_CLUSTER_FULL_NAME"`. - Set the `--namespace` to the same [scope](https://www.mongodb.com/docs/kubernetes/current/multi-cluster-prerequisites.md#std-label-mc-namespace-scope-ref) that you used for your multi-Kubernetes cluster MongoDB deployment, such as: `kubectl config --namespace "mongodb"`. ```sh kubectl config set-context $(kubectl config current-context) --namespace= ``` 2. Invoke the following command to create a ConfigMap. ```sh cat <` placeholder as follows:`https://ops.example.com:8443/` `v2#/org//projects` You must have the [Organization Project Creator](https://www.mongodb.com/docs/ops-manager/current/reference/user-roles/#Organization Project Creator) role to create a new project within an existing Cloud Manager or Ops Manager organization. If you provide an empty string as your `orgId`, Kubernetes Operator creates an organization with the same name as your project. | `5b890e0feacf0b76ff3e7183` | | `data.baseUrl` | string | URL (Uniform Resource Locator) to your Ops Manager Application including the FQDN (fully qualified domain name) and port number. IMPORTANT: If you deploy Ops Manager with the Kubernetes Operator and Ops Manager will manage MongoDB database resources deployed **outside** of the Kubernetes cluster it's deployed to, you must set `data.baseUrl` to the same value of the [`spec.configuration.mms.centralUrl`](https://www.mongodb.com/docs/kubernetes/current/reference/k8s-operator-om-specification.md#mongodb-opsmgrkube-opsmgrkube.spec.configuration) setting in the Ops Manager resource specification. To learn more, see [Managing External MongoDB Deployments.](https://www.mongodb.com/docs/kubernetes/current/tutorial/configure-om-resource.md#std-label-mdb-resource-deployment-locations) If you're using Cloud Manager, set the `data.baseUrl` value to `https://cloud.mongodb.com`. | `https://ops.example.com:8443` | 3. Invoke the following Kubernetes command to verify your [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/). ```sh kubectl describe configmaps ``` This command returns a ConfigMap description in the shell: ```sh Name: Namespace: Labels: Annotations: Data ==== baseUrl: ---- Events: ``` ## Connect to HTTPS-enabled Ops Manager Using a Custom CA You might have chosen to use your own TLS (Transport Layer Security) certificate to enable HTTPS (Hypertext Transfer Protocol Secure) for your Ops Manager instance. If you used a custom certificate, you need to add the CA that signed that custom certificate to the Kubernetes Operator. To add your custom CA, complete the following: 1. Create a ConfigMap for the certificate authority (CA) certificate. The Kubernetes Operator requires the root CA (Certificate Authority) certificate of the CA (Certificate Authority) that issued the [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/) host's certificate. Run the following command to create a [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) containing the root CA (Certificate Authority) in the same namespace of your database Pods: ```sh kubectl -n create configmap \ --from-file=mms-ca.crt ``` **Important:** The Kubernetes Operator requires that you name the Ops Manager resource's certificate `mms-ca.crt` in the ConfigMap. 2. Copy the highlighted section of the following example `ConfigMap`. ```yaml --- apiVersion: v1 kind: ConfigMap metadata: name: namespace: data: projectName: # this is an optional parameter orgId: # this is a required parameter baseUrl: https:// ``` ```yaml sslMMSCAConfigMap: sslRequireValidMMSServerCertificates: ‘true’ ... ``` 3. Add the highlighted section to your project's ConfigMap. Invoke the following command to edit your project's ConfigMap in the default configured editor: ```sh kubectl edit configmaps -n ``` Paste the highlighted section in the example [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) at the end of the project ConfigMap. 4. Specify the TLS settings Change the following TLS (Transport Layer Security) keys: | Key | Type | Description | Example | | --- | --- | --- | --- | | `sslMMSCAConfigMap` | string | Name of the [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/) created in the first step containing the root CA (Certificate Authority) certificate used to sign the Ops Manager host's certificate. This mounts the CA certificate to the Kubernetes Operator and database resources. | `my-root-ca` | | `sslRequireValidMMSServerCertificates` | boolean | Forces the Operator to require a valid TLS (Transport Layer Security) certificate from [Ops Manager](https://www.mongodb.com/docs/ops-manager/current/). IMPORTANT: The value must be enclosed in single quotes or the operator will throw an error. | `'true'` | 5. Save your updated ConfigMap. 6. Invoke the Kubernetes command to verify your [ConfigMap](https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/). ```sh kubectl describe configmaps -n ``` **Important:** Always include the namespace option with `kubectl`. [kubectl](https://kubernetes.io/docs/reference/kubectl/kubectl/) defaults to an empty namespace if you don't specify the `-n` option, resulting in deployment failures. You must specify the value of the `` field. The Kubernetes Operator, [secret](https://kubernetes.io/docs/concepts/configuration/secret/), and `MongoDB` resources should run in the same unique namespace. This command returns a ConfigMap description in the shell: ```sh Name: Namespace: Labels: Annotations: Data ==== sslMMSCAConfigMap: ---- sslRequireValidMMSServerCertificates: ---- true Events: ``` ## Next Steps Now that you created your ConfigMap, [Create Credentials for the Kubernetes Operator](https://www.mongodb.com/docs/kubernetes/current/tutorial/create-operator-credentials.md#std-label-create-k8s-secret) before you start [deploying MongoDB resources.](https://www.mongodb.com/docs/kubernetes/current/deploy.md)