You can use the Kubernetes Operator and deploy the mongot process resources to run with MongoDB Community Edition v8.3 or later on a Kubernetes cluster. The mongot process supports both MongoDB Search and Vector Search. Optionally, you can enable and configure Vector Search to automatically generate vector embeddings for text data in your collections and queries using a supported Voyage AI embedding model.
Important
Automated embedding is in Preview. The feature and the corresponding documentation might change at any time during the preview period. To learn more, see Preview Features.
The following procedure demonstrates how to deploy and configure MongoDB Search and Vector Search to run with a new or existing replica set in your Kubernetes cluster. The deployment uses TLS certificates to ensure secure communication between MongoDB nodes and the mongot search process.
Prerequisites
To deploy MongoDB Search and Vector Search, you must have the following:
A running Kubernetes cluster.
Kubernetes command-line tool,
kubectl, configured to communicate with your cluster.Helm, the package manager for Kubernetes, to install the Kubernetes Operator.
cert-manager or an alternative certificate management solution for TLS certificate provisioning.
Bash v5.1 or later for running the commands in this tutorial.
Optionally, to configure Vector Search to automatically generate vector embeddings for text data in your collections and queries, you must create API keys for the embedding service. We recommend creating two keys, one for generating embeddings at index-time for text data in your collection and another for generating embeddings at query-time for your query text. If you don't have the keys, you can create the keys from the Atlas UI.
Procedure
Required. Set the environment variables.
Set the environment variables for use in the subsequent steps in this procedure. Copy the following commands, update the values for your environment, and then run them to load the variables:
1 # set it to the context name of the k8s cluster 2 export K8S_CTX="<local cluster context>" 3 4 # the following namespace will be created if not exists 5 export MDB_NS="mongodb" 6 7 # MongoDBCommunity resource name referenced throughout the guide 8 export MDB_RESOURCE_NAME="mdbc-rs" 9 # Number of replica set members deployed in the sample MongoDBCommunity 10 export MDB_MEMBERS=3 11 12 # TLS-related secret names used for MongoDBCommunity and MongoDBSearch 13 export MDB_TLS_CA_SECRET_NAME="${MDB_RESOURCE_NAME}-ca" 14 export MDB_TLS_SERVER_CERT_SECRET_NAME="${MDB_RESOURCE_NAME}-tls" 15 export MDB_SEARCH_TLS_SECRET_NAME="${MDB_RESOURCE_NAME}-search-tls" 16 17 export MDB_TLS_CA_CONFIGMAP="${MDB_RESOURCE_NAME}-ca-configmap" 18 export MDB_TLS_SELF_SIGNED_ISSUER="${MDB_RESOURCE_NAME}-selfsigned-cluster-issuer" 19 export MDB_TLS_CA_CERT_NAME="${MDB_RESOURCE_NAME}-selfsigned-ca" 20 export MDB_TLS_CA_ISSUER="${MDB_RESOURCE_NAME}-cluster-issuer" 21 22 export MDB_VERSION="8.3.4" 23 24 # root admin user for convenience, not used here at all in this guide 25 export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME" 26 # regular user performing restore and search queries on sample mflix database 27 export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME" 28 # user for MongoDB Search to connect to the replica set to synchronise data from 29 export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME" 30 31 export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes" 32 # comma-separated key=value pairs for additional parameters passed to the helm-chart installing the operator 33 export OPERATOR_ADDITIONAL_HELM_VALUES="" 34 35 # TLS is mandatory; connection string must include tls=true 36 export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_RESOURCE_NAME}-0.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017/?replicaSet=${MDB_RESOURCE_NAME}&tls=true&tlsCAFile=/tls/ca.crt" 37 38 export CERT_MANAGER_NAMESPACE="cert-manager" 39 40 # Vector Search auto embedding related configurations 41 export AUTO_EMBEDDING_API_KEY_SECRET_NAME="voyage-api-keys" 42 export AUTO_EMBEDDING_API_QUERY_KEY="<embedding-model-query-key>" 43 export AUTO_EMBEDDING_API_INDEXING_KEY="<embedding-model-indexing-key>" 44 export PROVIDER_ENDPOINT="https://ai.mongodb.com/v1/embeddings" 45 export EMBEDDING_MODEL="voyage-4"
Note
If you have the API keys to enable Vector Search to automatically generate embeddings, replace the following placeholder values in the environment variables:
| API key for generating embeddings for the query text. |
| API key for generating embeddings for text data in your collection at index-time. |
| Embedding model provider's endpoint. Value defaults to |
To verify that all necessary environment variables are set, run the following code in your terminal:
1 required=( 2 K8S_CTX 3 MDB_NS 4 MDB_RESOURCE_NAME 5 MDB_VERSION 6 MDB_MEMBERS 7 CERT_MANAGER_NAMESPACE 8 MDB_TLS_CA_SECRET_NAME 9 MDB_TLS_SERVER_CERT_SECRET_NAME 10 MDB_SEARCH_TLS_SECRET_NAME 11 MDB_ADMIN_USER_PASSWORD 12 MDB_SEARCH_SYNC_USER_PASSWORD 13 MDB_USER_PASSWORD 14 OPERATOR_HELM_CHART 15 ) 16 17 missing_req=() 18 for v in "${required[@]}"; do [[ -n "${!v:-}" ]] || missing_req+=("${v}"); done 19 20 if (( ${#missing_req[@]} )); then 21 echo "ERROR: Missing required environment variables:" >&2 22 for m in "${missing_req[@]}"; do echo " - ${m}" >&2; done 23 else 24 echo "All required environment variables present." 25 fi
Conditional. Add the MongoDB Helm repository.
Helm automates the deployment and management of MongoDB instances on Kubernetes. If you already have the Helm repository that contains the Helm chart for installing the Kubernetes Operator operator, or skip this step. Otherwise, add the Helm repository.
To add the Helm repository, copy, paste, and run the following:
1 helm repo add mongodb https://mongodb.github.io/helm-charts 2 helm repo update mongodb 3 helm search repo mongodb/mongodb-kubernetes
Conditional. Install the MongoDB Controllers for Kubernetes Operator.
The Kubernetes Operator watches MongoDBCommunity and MongoDBSearch custom resources and manages the lifecycle of your MongoDB deployments. If you already installed the MongoDB Controllers for Kubernetes Operator, skip this step. Otherwise, install the MongoDB Controllers for Kubernetes Operator from the Helm repository you added in the previous step.
To install the MongoDB Controllers for Kubernetes Operator in the mongodb namespace, copy, paste, and run the following commands:
1 helm upgrade --install --debug --kube-context "${K8S_CTX}" \ 2 --create-namespace \ 3 --namespace="${MDB_NS}" \ 4 mongodb-kubernetes \ 5 {OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \ 6 "${OPERATOR_HELM_CHART}"
Optional. Wait for the operator deployment.
Ensure that the Kubernetes Operator is fully operational before proceeding with the MongoDB Search and Vector Search deployment. Run the following command to verify that all operator components are running and available.
1 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" rollout status --timeout=2m deployment/mongodb-kubernetes-operator 2 echo "Operator deployment in ${MDB_NS} namespace" 3 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get deployments 4 echo; echo "Operator pod in ${MDB_NS} namespace" 5 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
Required. Create and load the MongoDB user secrets.
MongoDB requires authentication for secure access. In this step, you create three Kubernetes secrets:
mdb-admin-user-password: Credentials for the MongoDB administrator.mdb-user-password: Credentials for the user authorized to perform search queries.mdbc-rs-search-sync-source-password: Credentials for a dedicated search user used internally by themongotprocess to synchronize data and manage indexes.
Kubernetes Operator uses passwords from those secrets to automatically create the users in the MongoDB database.
To create the secrets, copy, paste, and run the following command:
1 Create admin user secret 2 kubectl create secret generic mdb-admin-user-password \ 3 --from-literal=password="${MDB_ADMIN_USER_PASSWORD}" \ 4 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 5 6 Create search sync source user secret 7 kubectl create secret generic "${MDB_RESOURCE_NAME}-search-sync-source-password" \ 8 --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}" \ 9 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 10 11 Create regular user secret 12 kubectl create secret generic mdb-user-password \ 13 --from-literal=password="${MDB_USER_PASSWORD}" \ 14 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 15 16 echo "User secrets created."
Conditional. Install the cert-manager.
The cert-manager is required for managing TLS certificates. If you already have cert-manager installed in your cluster, skip this step. Otherwise, install cert-manager using Helm.
To install cert-manager in the cert-manager namespace, run the following command in your terminal:
1 helm upgrade --install \ 2 cert-manager \ 3 oci://quay.io/jetstack/charts/cert-manager \ 4 --kube-context "${K8S_CTX}" \ 5 --namespace "${CERT_MANAGER_NAMESPACE}" \ 6 --create-namespace \ 7 --set crds.enabled=true 8 9 for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do 10 kubectl --context "${K8S_CTX}" \ 11 -n "${CERT_MANAGER_NAMESPACE}" \ 12 wait --for=condition=Available "deployment/${deployment}" --timeout=300s 13 done 14 15 echo "cert-manager is ready in namespace ${CERT_MANAGER_NAMESPACE}."
Required. Prepare certificate issuer and CA infrastructure.
Create the certificate authority infrastructure that will issue TLS certificates for MongoDB and MongoDBSearch resources. The commands perform the following actions:
Create a self-signed
ClusterIssuer.Generate a CA certificate.
Publish a cluster-wide CA issuer that all namespaces can use.
Expose the CA bundle through a
ConfigMapso that MongoDB resources can use it.
1 Bootstrap a self-signed ClusterIssuer that will mint the CA material consumed by 2 the MongoDBCommunity deployment. 3 kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST 4 apiVersion: cert-manager.io/v1 5 kind: ClusterIssuer 6 metadata: 7 name: ${MDB_TLS_SELF_SIGNED_ISSUER} 8 spec: 9 selfSigned: {} 10 EOF_MANIFEST 11 12 kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_SELF_SIGNED_ISSUER}" 13 14 Create the CA certificate and secret in the cert-manager namespace. 15 kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST 16 apiVersion: cert-manager.io/v1 17 kind: Certificate 18 metadata: 19 name: ${MDB_TLS_CA_CERT_NAME} 20 namespace: ${CERT_MANAGER_NAMESPACE} 21 spec: 22 isCA: true 23 commonName: ${MDB_TLS_CA_CERT_NAME} 24 secretName: ${MDB_TLS_CA_SECRET_NAME} 25 privateKey: 26 algorithm: ECDSA 27 size: 256 28 issuerRef: 29 name: ${MDB_TLS_SELF_SIGNED_ISSUER} 30 kind: ClusterIssuer 31 EOF_MANIFEST 32 33 kubectl --context "${K8S_CTX}" wait --for=condition=Ready -n "${CERT_MANAGER_NAMESPACE}" certificate "${MDB_TLS_CA_CERT_NAME}" 34 35 Publish a cluster-scoped issuer that fronts the generated CA secret so all namespaces can reuse it. 36 kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST 37 apiVersion: cert-manager.io/v1 38 kind: ClusterIssuer 39 metadata: 40 name: ${MDB_TLS_CA_ISSUER} 41 spec: 42 ca: 43 secretName: ${MDB_TLS_CA_SECRET_NAME} 44 EOF_MANIFEST 45 46 kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_CA_ISSUER}" 47 48 TMP_CA_CERT="$(mktemp)" 49 50 kubectl --context "${K8S_CTX}" \ 51 get secret "${MDB_TLS_CA_SECRET_NAME}" -n "${CERT_MANAGER_NAMESPACE}" \ 52 -o jsonpath="{.data['ca\\.crt']}" | base64 --decode > "${TMP_CA_CERT}" 53 54 Expose the CA bundle through a ConfigMap for workloads and the MongoDBCommunity resource. 55 kubectl --context "${K8S_CTX}" create configmap "${MDB_TLS_CA_CONFIGMAP}" -n "${MDB_NS}" \ 56 --from-file=ca-pem="${TMP_CA_CERT}" --from-file=mms-ca.crt="${TMP_CA_CERT}" \ 57 --from-file=ca.crt="${TMP_CA_CERT}" \ 58 --dry-run=client -o yaml | kubectl --context "${K8S_CTX}" apply -f - 59 60 echo "Cluster-wide CA issuer ${MDB_TLS_CA_ISSUER} is ready."
Required. Issue TLS certificates.
Issue TLS certificates for both the MongoDB server and the MongoDBSearch service. The MongoDB server certificate includes all necessary DNS names for the pod and service communication. Both certificates support server and client authentication.
1 server_certificate="${MDB_RESOURCE_NAME}-server-tls" 2 search_certificate="${MDB_RESOURCE_NAME}-search-tls" 3 4 mongo_dns_names=() 5 for ((member = 0; member < MDB_MEMBERS; member++)); do 6 mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}") 7 mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local") 8 done 9 mongo_dns_names+=( 10 "${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local" 11 "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local" 12 ) 13 14 search_dns_names=( 15 "*.${MDB_RESOURCE_NAME}-search-0-svc.${MDB_NS}.svc.cluster.local" 16 ) 17 18 render_dns_list() { 19 local dns_list=("$@") 20 for dns in "${dns_list[@]}"; do 21 printf " - \"%s\"\n" "${dns}" 22 done 23 } 24 25 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF_MANIFEST 26 apiVersion: cert-manager.io/v1 27 kind: Certificate 28 metadata: 29 name: ${server_certificate} 30 namespace: ${MDB_NS} 31 spec: 32 secretName: ${MDB_TLS_SERVER_CERT_SECRET_NAME} 33 issuerRef: 34 name: ${MDB_TLS_CA_ISSUER} 35 kind: ClusterIssuer 36 duration: 240h0m0s 37 renewBefore: 120h0m0s 38 usages: 39 - digital signature 40 - key encipherment 41 - server auth 42 - client auth 43 dnsNames: 44 (render_dns_list "${mongo_dns_names[@]}") 45 --- 46 apiVersion: cert-manager.io/v1 47 kind: Certificate 48 metadata: 49 name: ${search_certificate} 50 namespace: ${MDB_NS} 51 spec: 52 secretName: ${MDB_SEARCH_TLS_SECRET_NAME} 53 issuerRef: 54 name: ${MDB_TLS_CA_ISSUER} 55 kind: ClusterIssuer 56 duration: 240h0m0s 57 renewBefore: 120h0m0s 58 usages: 59 - digital signature 60 - key encipherment 61 - server auth 62 - client auth 63 dnsNames: 64 (render_dns_list "${search_dns_names[@]}") 65 EOF_MANIFEST 66 67 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${server_certificate}" --timeout=300s 68 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${search_certificate}" --timeout=300s 69 70 echo "MongoDB TLS certificates have been issued."
Conditional. Create and deploy the MongoDB Community resource.
If you've already deployed the MongoDB Community Edition, skip this step. Otherwise, deploy the MongoDB Community Edition.
To deploy the MongoDB Community Edition, complete the following steps:
Create a
MongoDBCommunitycustom resource namedmdb-rs.The resource defines CPU and memory resources for the
mongodandmongodb-agentcontainers, and sets up the following three users:mdb-userUser that can restore database and run search queries. This user uses the
mdb-user-passwordsecret to perform these operations.search-sync-sourceUser that MongoDB Search uses to connect to MongoDB database in order to manage and build indexes. This user uses
searchCoordinatorrole that the Kubernetes operator creates. This uses uses themdbc-rs-search-sync-source-passwordsecret to connectmongottomongod.admin-userDatabase admin user.
The Kubernetes Operator uses this resource to configure a MongoDB replica set with 3 members.
To create the secrets, copy, paste, and run the following commands:
1 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF 2 apiVersion: mongodbcommunity.mongodb.com/v1 3 kind: MongoDBCommunity 4 metadata: 5 name: ${MDB_RESOURCE_NAME} 6 spec: 7 version: ${MDB_VERSION} 8 type: ReplicaSet 9 members: ${MDB_MEMBERS} 10 security: 11 tls: 12 enabled: true 13 certificateKeySecretRef: 14 name: ${MDB_TLS_SERVER_CERT_SECRET_NAME} 15 caConfigMapRef: 16 name: ${MDB_TLS_CA_CONFIGMAP} 17 authentication: 18 ignoreUnknownUsers: true 19 modes: 20 - SCRAM 21 agent: 22 logLevel: DEBUG 23 statefulSet: 24 spec: 25 template: 26 spec: 27 containers: 28 - name: mongod 29 resources: 30 limits: 31 cpu: "2" 32 memory: 2Gi 33 requests: 34 cpu: "1" 35 memory: 1Gi 36 - name: mongodb-agent 37 resources: 38 limits: 39 cpu: "1" 40 memory: 2Gi 41 requests: 42 cpu: "0.5" 43 memory: 1Gi 44 users: 45 # admin user with root role 46 - name: mdb-admin 47 db: admin 48 # a reference to the secret containing user password 49 passwordSecretRef: 50 name: mdb-admin-user-password 51 scramCredentialsSecretName: mdb-admin-user 52 roles: 53 - name: root 54 db: admin 55 # user performing search queries 56 - name: mdb-user 57 db: admin 58 # a reference to the secret containing user password 59 passwordSecretRef: 60 name: mdb-user-password 61 scramCredentialsSecretName: mdb-user-scram 62 roles: 63 - name: restore 64 db: sample_mflix 65 - name: readWrite 66 db: sample_mflix 67 # user used by MongoDB Search to connect to MongoDB database to 68 # synchronize data from. 69 # For MongoDB <8.2, the operator will be creating the 70 # searchCoordinator custom role automatically. 71 # From MongoDB 8.2, searchCoordinator role will be a 72 # built-in role. 73 - name: search-sync-source 74 db: admin 75 # a reference to the secret that will be used to generate the user's password 76 passwordSecretRef: 77 name: ${MDB_RESOURCE_NAME}-search-sync-source-password 78 scramCredentialsSecretName: ${MDB_RESOURCE_NAME}-search-sync-source 79 roles: 80 - name: searchCoordinator 81 db: admin 82 EOF Wait for the
MongoDBCommunityresource deployment to complete.When you apply the
MongoDBCommunitycustom resource, the Kubernetes operator begins deploying the MongoDB nodes (pods). This step pauses the execution until themdbc-rsresource's status phase isRunning, which indicates that the MongoDB Community replica set is operational.1 echo "Waiting for MongoDBCommunity resource to reach Running phase..." 2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \ 3 --for=jsonpath='{.status.phase}'=Running mdbc/mdbc-rs --timeout=400s 4 echo; echo "MongoDBCommunity resource" 5 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs 6 echo; echo "Pods running in cluster ${K8S_CTX}" 7 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
Required. Create and deploy the resource for MongoDB Search and Vector Search.
You can deploy one instance of the search node without any load balancing.
To deploy, complete the following steps:
Create a MongoDBSearch custom resource named
mdbc-rs.This resource specifies the CPU and memory resource requirements for the search nodes. To learn more about the settings in this custom resource, see MongoDB Search and Vector Search Settings.
Wait for the MongoDBSearch resource deployment to complete.
When you apply the MongoDBSearch custom resource, the Kubernetes operator begins deploying the search nodes (pods). This step pauses the execution until the
mdbc-rsMongoDBSearch resource's status phase isRunning, which indicates that the MongoDB Search is operational.1 echo "Waiting for MongoDBSearch resource to reach Running phase..." 2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \ 3 --for=jsonpath='{.status.phase}'=Running mdbs/"${MDB_RESOURCE_NAME}" --timeout=300s
Optional. Verify the MongoDB Community resource status.
Ensure that the MongoDBCommunity resource deployment with MongoDBSearch was successful.
1 echo "Waiting for MongoDBCommunity resource to reach Running phase..." 2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \ 3 --for=jsonpath='{.status.phase}'=Running mdbc/mdbc-rs --timeout=400s 4 echo; echo "MongoDBCommunity resource" 5 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs 6 echo; echo "Pods running in cluster ${K8S_CTX}" 7 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
Optional. View all the running pods in your namespace.
View all the running pods in your namespace pods for the MongoDB replica set members, the MongoDB Controllers for Kubernetes Operator, and the Search nodes.
1 echo; echo "MongoDBCommunity resource" 2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs 3 echo; echo "MongoDBSearch resource" 4 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbs/mdbc-rs 5 echo; echo "Pods running in cluster ${K8S_CTX}" 6 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
Verify the Deployment
After the procedure completes, confirm the deployment is healthy before running queries.
Checkpoint | Verification Step |
|---|---|
MongoDB Community resource running | Run |
MongoDB Search resource running | Run |
All pods healthy | Run |
Search queries succeed | Connect to the replica set and run a MongoDB Search or Vector Search query to confirm the search index is reachable. |
Next Steps
After you deploy MongoDB Search and Vector Search with MongoDB Community Edition, you can:
Add data and run queries: Load data into your MongoDB cluster, create MongoDB Search and Vector Search indexes, and run queries against your data. To learn more, see Use MongoDB Search and Vector Search.
Configure Search settings: Adjust resource settings for your search deployment. To learn more, see MongoDB Search and Vector Search Settings.