For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.
Docs Menu
Docs Home
/ /
Deploy Ops Manager
Docs Home
/
Management
/
Controllers for Kubernetes Operator
/
Deploy Ops Manager
Docs Home
/
Management
/
Controllers for Kubernetes Operator
/
Deploy Ops Manager

Deploy Ops Manager with an External Application Database

You can deploy an Ops Manager resource that uses an external Application Database: a MongoDB custom resource with spec.role set to AppDB, which a second Ops Manager instance manages as a project. This lets Ops Manager back up and restore the Application Database. To learn more, see Back Up the Ops Manager Application Database.

This procedure deploys a new Ops Manager instance. To convert an existing Ops Manager instance that uses an internally managed Application Database, see Migrate an Application Database to an External Deployment.

This procedure deploys the following resources:

  • A management Ops Manager instance with its own internally managed Application Database. This instance manages the project that contains the external Application Database.

  • An external Application Database: a MongoDB replica set with spec.role set to AppDB, named <primary-om-name>-db.

  • A primary Ops Manager instance that omits spec.applicationDatabase and references the external Application Database with spec.externalApplicationDatabaseRef.

Prerequisites

Before you begin, complete the following tasks:

  • Deploy a Kubernetes cluster with a default StorageClass.

  • Install kubectl and helm and configure them for that cluster.

  • Obtain access to the Kubernetes Operator Helm chart.

Considerations

Set the Ops Manager version and the Application Database version to a consistent pair. The management Ops Manager instance manages the external Application Database, so the Application Database version must be a MongoDB version that the management Ops Manager instance offers in its version manifest. For example, an 8.0.x Ops Manager instance offers 8.0.x MongoDB versions, but a 7.0.x Ops Manager instance doesn't.

Procedure

1

Set the environment variables for the deployment.

export K8S_CTX="<your-kube-context>"
export MDB_NS="mongodb"
export OPERATOR_HELM_CHART="oci://quay.io/mongodb/helm-charts/mongodb-kubernetes"
export OM_VERSION="8.0.7"
export APPDB_VERSION="8.0.5-ent"
export MANAGEMENT_OM_NAME="management-om"
export PRIMARY_OM_NAME="primary-om"
export APPDB_NAME="${PRIMARY_OM_NAME}-db"
export MANAGEMENT_OM_URL="http://${MANAGEMENT_OM_NAME}-svc.${MDB_NS}.svc.cluster.local:8080"
export MANAGEMENT_OM_ADMIN_KEY_SECRET="${MDB_NS}-${MANAGEMENT_OM_NAME}-admin-key"
export APPDB_PROJECT_CONFIGMAP="${APPDB_NAME}-config"
export APPDB_PROJECT_NAME="external-appdb"
export APPDB_CONNECTION_STRING_SECRET="${APPDB_NAME}-connection-string"
export OM_ADMIN_EMAIL="admin@example.com"
export OM_ADMIN_PASSWORD="<your-password>"
export OM_ADMIN_FIRST_NAME="Admin"
export OM_ADMIN_LAST_NAME="User"

The Kubernetes Operator requires the external Application Database to be named <primary-om-name>-db, which is why APPDB_NAME derives from PRIMARY_OM_NAME.

2

Create the namespace.

kubectl create namespace "${MDB_NS}" --context "${K8S_CTX}"
3

Install the Kubernetes Operator.

helm upgrade --install --kube-context "${K8S_CTX}" \
  --namespace "${MDB_NS}" --create-namespace \
  mongodb-kubernetes "${OPERATOR_HELM_CHART}"
kubectl rollout status deployment/mongodb-kubernetes-operator \
  --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=300s
4

Create the Ops Manager admin secret.

Both Ops Manager resources reference this secret with spec.adminCredentials.

kubectl create secret generic ops-manager-admin-secret \
  --context "${K8S_CTX}" -n "${MDB_NS}" \
  --from-literal=Username="${OM_ADMIN_EMAIL}" \
  --from-literal=Password="${OM_ADMIN_PASSWORD}" \
  --from-literal=FirstName="${OM_ADMIN_FIRST_NAME}" \
  --from-literal=LastName="${OM_ADMIN_LAST_NAME}"
5

Deploy the management Ops Manager instance.

kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
apiVersion: mongodb.com/v1
kind: MongoDBOpsManager
metadata:
  name: ${MANAGEMENT_OM_NAME}
spec:
  replicas: 1
  version: ${OM_VERSION}
  adminCredentials: ops-manager-admin-secret
  applicationDatabase:
    members: 3
    version: ${APPDB_VERSION}
  backup:
    enabled: false
  configuration:
    automation.versions.source: mongodb
    mms.ignoreInitialUiSetup: "true"
    mms.adminEmailAddr: admin@example.com
    mms.fromEmailAddr: admin@example.com
    mms.replyToEmailAddr: admin@example.com
    mms.mail.hostname: email-smtp.us-east-1.amazonaws.com
    mms.mail.port: "465"
    mms.mail.ssl: "true"
    mms.mail.transport: smtp
    mms.minimumTLSVersion: TLSv1.2
EOF

The mms.* mail settings are required. When mms.ignoreInitialUiSetup is true, the Ops Manager pre-flight check doesn't start Ops Manager unless mms.fromEmailAddr and the related mail settings are present.

6

Wait for the management Ops Manager instance to become ready.

  1. Wait for the internally managed Application Database and the Ops Manager resource:

    kubectl wait --for=jsonpath='{.status.applicationDatabase.phase}'=Running \
      om/"${MANAGEMENT_OM_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=1200s
    kubectl wait --for=jsonpath='{.status.opsManager.phase}'=Running \
      om/"${MANAGEMENT_OM_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=1800s

  2. Confirm that the Ops Manager public API answers requests. An opsManager.phase of Running means that the Ops Manager pod is up, but the API that the Kubernetes Operator uses to create the Application Database project can lag by a few seconds. A 401 response is the expected unauthenticated response and means that the API is ready:

    om_pod="${MANAGEMENT_OM_NAME}-0"
    until [ "$(kubectl exec "${om_pod}" -c mongodb-ops-manager --context "${K8S_CTX}" -n "${MDB_NS}" -- \
      curl -s -o /dev/null -w '%{http_code}' \
      "http://$(kubectl get pod "${om_pod}" --context "${K8S_CTX}" -n "${MDB_NS}" \
        -o jsonpath='{.status.podIP}'):8080/api/public/v1.0" 2>/dev/null)" = "401" ]; do
      echo "waiting for management Ops Manager public API..."; sleep 10
    done

  3. Confirm that the Kubernetes Operator created the programmatic API key secret for the management Ops Manager instance:

    kubectl get secret "${MANAGEMENT_OM_ADMIN_KEY_SECRET}" \
      --context "${K8S_CTX}" -n "${MDB_NS}"
7

Create the project ConfigMap for the external Application Database.

kubectl create configmap "${APPDB_PROJECT_CONFIGMAP}" \
  --context "${K8S_CTX}" -n "${MDB_NS}" \
  --from-literal=baseUrl="${MANAGEMENT_OM_URL}" \
  --from-literal=projectName="${APPDB_PROJECT_NAME}" \
  --from-literal=orgId=""
8

Create the external Application Database.

kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
apiVersion: mongodb.com/v1
kind: MongoDB
metadata:
  name: ${APPDB_NAME}
spec:
  members: 3
  version: ${APPDB_VERSION}
  type: ReplicaSet
  role: AppDB
  opsManager:
    configMapRef:
      name: ${APPDB_PROJECT_CONFIGMAP}
  credentials: ${MANAGEMENT_OM_ADMIN_KEY_SECRET}
  persistent: true
EOF
kubectl wait --for=jsonpath='{.status.phase}'=Running \
  mdb/"${APPDB_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=1200s

When you set spec.role to AppDB, the Kubernetes Operator configures SCRAM authentication for the resource. To learn more, see spec.role.

9

Deploy the primary Ops Manager instance.

This resource omits spec.applicationDatabase and references the external Application Database instead.

kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
apiVersion: mongodb.com/v1
kind: MongoDBOpsManager
metadata:
  name: ${PRIMARY_OM_NAME}
spec:
  replicas: 1
  version: ${OM_VERSION}
  adminCredentials: ops-manager-admin-secret
  externalApplicationDatabaseRef:
    name: ${APPDB_NAME}
    kind: MongoDB
  backup:
    enabled: false
  configuration:
    automation.versions.source: mongodb
    mms.ignoreInitialUiSetup: "true"
    mms.adminEmailAddr: admin@example.com
    mms.fromEmailAddr: admin@example.com
    mms.replyToEmailAddr: admin@example.com
    mms.mail.hostname: email-smtp.us-east-1.amazonaws.com
    mms.mail.port: "465"
    mms.mail.ssl: "true"
    mms.mail.transport: smtp
    mms.minimumTLSVersion: TLSv1.2
EOF

To enable backup for your MongoDB deployments, set spec.backup.enabled to true on this resource and configure snapshot storage. To learn more, see Configure File System Backup Store with Kubernetes Operator.

10

Wait for the primary Ops Manager instance to become ready.

kubectl wait --for=jsonpath='{.status.opsManager.phase}'=Running \
  om/"${PRIMARY_OM_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=1800s
kubectl wait --for=jsonpath='{.status.applicationDatabase.phase}'=Disabled \
  om/"${PRIMARY_OM_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" --timeout=600s

The Kubernetes Operator doesn't manage an internal Application Database for an Ops Manager resource that uses an external Application Database, so status.applicationDatabase.phase reports Disabled. This is expected and isn't an error.

11

Verify the deployment.

  1. Confirm that the management Ops Manager pods, the external Application Database pods, and the primary Ops Manager pods are running:

    kubectl get pods --context "${K8S_CTX}" -n "${MDB_NS}"

  2. Confirm that the MongoDB resource owns the Application Database StatefulSet, and that the primary Ops Manager resource doesn't:

    kubectl get statefulset "${APPDB_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" \
      -o jsonpath='{range .metadata.ownerReferences[*]}{.kind}/{.name}{"\n"}{end}'

    The command returns MongoDB/${APPDB_NAME}.

  3. Confirm that the Kubernetes Operator created the connection string secret for the primary Ops Manager instance:

    kubectl get secret "${APPDB_CONNECTION_STRING_SECRET}" \
      --context "${K8S_CTX}" -n "${MDB_NS}"

Common External Application Database Issues

The MongoDB Resource Reports a Version Error

If the external Application Database reports Failed with a message that the MongoDB version isn't available, set spec.version to a version that the management Ops Manager instance offers. Keep the Ops Manager version and the Application Database version on the same major version. The management Ops Manager instance's own internally managed Application Database isn't affected, because it downloads binaries directly when you set automation.versions.source to mongodb.

The External Application Database Stays Pending

If the external Application Database stays in the Pending phase and the MongoDB Agent never receives an automation configuration, you might have created the MongoDB resource before the management Ops Manager public API was serving requests. The Kubernetes Operator couldn't create the project. Confirm that the API readiness check returns 401, then reconcile the resource again.

The Operator Rejects the External Application Database Reference

The value of spec.externalApplicationDatabaseRef.name must be exactly <primary-om-name>-db, and the MongoDB resource must be in the same namespace as the Ops Manager resource.

Next Steps

To back up the external Application Database, enable backup on the MongoDB resource in the project that the management Ops Manager instance manages. To learn more, see Configure MongoDB Database Backups.

Back
Back Up the Application Database
Next
Migrate to an External Application Database
Rate this page

On this page