Release Notes for MongoDB Controllers for Kubernetes Operator

OpenID Connect (OIDC) user authentication

• Adds support for OpenID Connect (OIDC) user authentication.

• You can configure OIDC authentication with the spec.security.authentication.modes and spec.security.authentication.oidcProviderConfigs settings.

• Requires MongoDB Enterprise Server 7.0.11+ or 8.0.0+.

• For more information, see:

  • Enable Authentication
  • Manage Database Users Using OIDC Authentication

New ClusterMongoDBRole CRD

• Adds new ClusterMongoDBRole CRD to support reusable roles across multiple MongoDB clusters. This allows users to define roles once and reuse them in multiple MongoDB or MongoDBMultiCluster resources.

• You can reference this role using the spec.security.roleRefs field. Note that only one of spec.security.roles and spec.security.roleRefs can be used at a time.

• The operator treats ClusterMongoDBRole resources as custom role templates that are only used when referenced by the database resources.

• The operator watches the new resource by default. This means that the operator requires you to create a new ClusterRole and ClusterRoleBinding. The helm chart or the kubectl mongodb plugin create these ClusterRole and ClusterRoleBinding by default. You must create them manually if you use a different installation method.

• To disable this behavior in the helm chart, set the operator.enableClusterMongoDBRoles value to false. This disables the creation of the necessary RBAC resources for the ClusterMongoDBRole resource, as well as disables the watch for this resource.

• To skip installing necessary ClusterRole and ClusterRoleBinding with the kubectl mongodb plugin, set the --create-mongodb-roles-cluster-role to false.

• The new ClusterMongoDBRole resource is designed to be read-only, meaning it can be used by MongoDB deployments managed by different operators.

• You can delete the ClusterMongoDBRole resource at any time, but the operator does not delete any roles that were created using this resource. To properly remove access, you must manually remove the reference to the ClusterMongoDBRole in the MongoDB or MongoDBMultiCluster resources.

• The reference documentation for this resource can be found in the ClusterMongoDBRole Resource Specification.

Fixes an issue where moving a MongoDBMultiCluster resource to a new project (or a new Ops Manager instance) would leave the deployment in a failed state.

MongoDBSearch (Community Private Preview)

• Adds support for deploying MongoDB Search (Community Private Preview Edition).

• Enables full-text and vector search capabilities for MongoDBCommunity deployments.

• Adds new MongoDB CRD which is watched by default by the Kubernetes Operator. For more information see the Quick Start.

• MongoDBSearch Private Preview phase comes with the following limitations

  • Minimum MongoDB Community version: 8.0.

  • TLS must be disabled in MongoDB (communication between mongot and mongod is in plaintext for now).

Adds missing MongoDB Agent images in the Kubernetes Operator bundle in the OpenShift catalog and the operatorhub.io catalog.

Adds the missing mongodbcommunity CRD from the watched list in the Helm chart.