The kubectl mongodb plugin always adds the mongodb.com/migration-dry-run: true annotation to the resource it generates for migrating a deployment into Kubernetes. While that annotation is present, Kubernetes Operator makes no automation config changes. It only validates connectivity and credentials, so you can fix problems and re-run as many times as you need before Kubernetes Operator takes ownership of the deployment.
About this Task
Kubernetes Operator creates one Job per
MongoDBresource, named<resourceName>-connectivity-check. The Job dials every external member and authenticates against it. It deletes itself usingttlSecondsAfterFinished, and the next reconcile re-creates it, so re-validation after a fix is automatic. You do not need to trigger it manually.The dry run checks Kubernetes-to-virtual-machine reachability (DNS, TLS, firewalls, and member addresses) and credentials, including the
__systemrole on thelocaldatabase, and the CA when TLS is enabled.The dry run does not check virtual-machine-to-Kubernetes inbound connectivity. Verify that direction yourself, either through the Ops Manager UI monitoring status for the deployment or by running
rs.status()from a virtual machine member and confirming it can reach the Kubernetes Pods.The plugin and Kubernetes Operator version check runs regardless of whether the dry-run annotation is present.
Before you Begin
A generated
MongoDBcustom resource with themongodb.com/migration-dry-run: trueannotation still present. To learn how to generate this resource, see Migrate a Replica Set to Kubernetes.If the deployment uses TLS, the member certificates and CA material described in Configure TLS for a Migration to Kubernetes.
The Kubernetes Operator
ServiceAccounthasbatch/jobspermissions (create,get,list,watch, anddelete). Without this grant, Kubernetes Operator cannot create the connectivity validator Job at all.
Procedure
Apply the resource and let the dry run run.
Apply the MongoDB custom resource with the dry-run annotation still set. Kubernetes Operator creates the <resourceName>-connectivity-check Job and reports progress through status.phase and the NetworkConnectivityVerified condition.
While the Job runs, status.phase reads ConnectivityCheckRunning.
Read the result.
Read status.conditions[type=NetworkConnectivityVerified]:
Validator Job Exit Code | Condition Status | Reason | Meaning |
|---|---|---|---|
Job still running |
|
| The |
|
|
| All external members are reachable and authenticated. |
|
|
| Credentials, the authentication mechanism, or a missing |
|
|
| DNS, TLS, timeouts, or unreachable members. Check the Job Pod logs. |
|
|
| Unclassified failure. Check the Job Pod logs. |
Failures that occur before the Job starts use the reasons OperatorImageUnknown, BuildStatefulSetOptions, AgentCertSecretFailed, and AgentCertSubject.
Kubernetes Operator removes the NetworkConnectivityVerified condition from status.conditions entirely once no external members remain.
Fix problems and re-run, if needed.
Fix connectivity or credential problems in Kubernetes or in the Ops Manager UI, as needed. You do not need to delete or re-apply anything: the next reconcile re-creates the validator Job automatically.
If the dry run appears stuck, delete the <resourceName>-connectivity-check Job. The next reconcile re-creates it.
A missing batch/jobs RBAC grant on the Kubernetes Operator ServiceAccount prevents the Job from being created in the first place, so no condition or Job appears at all in that case. Failures that occur before the Job starts surface as reasons OperatorImageUnknown, BuildStatefulSetOptions, AgentCertSecretFailed, or AgentCertSubject instead of the exit-code reasons in the table above.
Remove the dry-run annotation to proceed.
When the NetworkConnectivityVerified condition is True with reason NetworkValidationPassed, remove the annotation:
kubectl annotate mdb <resourceName> \ mongodb.com/migration-dry-run-
Important
Removing the dry-run annotation is the point at which Kubernetes Operator takes ownership of the Ops Manager or Cloud Manager project. Treat this as the point of no return for the connectivity and credential state you just validated.