External Configuration Values for Self-Managed MongoDB

Use the __rest Expansion Directive

The __rest expansion directive loads configuration file values from a REST endpoint. __rest supports loading specific values in the configuration file or loading the entire configuration file.

storage:
  dbPath: "/var/lib/mongo"
systemLog:
  destination: file
  path: "/var/log/mongodb/mongod.log"
net:
  bindIp: 192.51.100.24,127.0.0.1
  tls:
    mode: requireTLS
    certificateKeyFile: "/etc/tls/mongod.pem"
    certificateKeyFilePassword:
      __rest: "https://myrestserver.example.net/api/config/myCertKeyFilePassword"
      type: "string"

__rest: "https://myrestserver.example.net/api/config/fullConfig"
type: "yaml"

Use the __exec Expansion Directive

The __exec expansion directive loads configuration file values from a shell or terminal command. __exec supports loading specific values in the configuration file or loading the entire configuration file.

storage:
  dbPath: "/var/lib/mongo"
systemLog:
  destination: file
  path: "/var/log/mongodb/mongod.log"
net:
  bindIp: 192.51.100.24,127.0.0.1
  tls:
    mode: requireTLS
    certificateKeyFile: "/etc/tls/mongod.pem"
    certificateKeyFilePassword:
      __exec: "python /home/myUserName/getPEMPassword.py"
      type: "string"

__exec: "python /home/myUserName/getFullConfig.py"
type: "yaml"

Expansion Directives Reference

__rest

The __rest expansion directive loads configuration file values from a REST endpoint. __rest supports loading specific values in the configuration file or loading the entire configuration file. The mongod then starts using the externally sourced values as part of its configuration.

The __rest expansion directive has the following syntax:

• To specify a REST endpoint for a specific configuration file setting or settings:

  <some configuration file setting>:
    __rest: "<string>"
    type: "string"
    trim: "none|whitespace"
    digest: "<string>"
    digest_key: "<string>"

• To specify a REST endpoint for the entire configuration file:

  __rest: "<string>"
  type: "yaml"
  trim: "none|whitespace"

  If specifying the entire configuration file via REST endpoint, the expansion directive and its options must be the only values specified in the configuration file.

__rest takes the following fields:

Field	Type	Description
__rest	string	Required The URL against which the mongod issues a GET request to retrieve the externally sourced value. For non-localhost REST endpoints (e.g. a REST endpoint hosted on a remote server), __rest requires encrypted (https://) URLs where both the host machine and the remote server support TLS 1.1 or later. If the REST endpoint specified in the URL requires authentication, encode credentials into the URL with the standard RFC 3986 User Information format. For localhost REST endpoints (e.g. a REST endpoint listening on the host machine), __rest allows unencrypted (http://) URLs. IMPORTANT: The value returned by the specified REST endpoint cannot include any additional expansion directives. The mongod does not perform additional processing on the returned data and will terminate with an error code if the returned data includes additional expansion directives.
type	string	Optional Controls how __rest parses the returned value from the specified URL. Possible values are: string (Default) Directs __rest to parse the returned data as a literal string. If specifying string, the entire __rest block and supporting options must be nested under the field for which you are loading externally sourced values. yaml Directs __rest to parse the returned data as a yaml formatted file. If specifying yaml, the __rest block must be the only content in the configuration file. The mongod replaces the configuration file contents with the yaml retrieved from the REST resource.
trim	string	Optional Specify whitespace to direct __rest to trim any leading or trailing whitespace, specifically occurrences of " ", "\r", "\n", "\t", "\v", and "\f". Defaults to none, or no trimming.
digest	string	Optional. The SHA-256 digest of the expansion result. If specified, you must also specify the digest_key.
digest_key	string	Optional. The hexadecimal string representation of the secret used to calculate the SHA-256 digest. If specified, you must also specify the digest.

Note

• If the configuration file includes the __rest expansion, on Linux/macOS, the read access to the configuration file must be limited to the user running the mongod / mongos process only.

• To enable parsing of the __rest expansion directive, start the mongod with the --configExpand "rest" option.

For examples, see Use the __rest Expansion Directive.

__exec

The __exec expansion directive loads configuration file values from the output of a shell or terminal command. __exec supports loading specific values in the configuration file or loading the entire configuration file. The mongod then starts using the externally sourced values as part of its configuration.

The __exec expansion directive has the following syntax:

• To specify a shell or terminal command for a specific configuration file setting or settings:

  <some configuration file setting>:
    __exec: "<string>"
    type: "string"
    trim: "none|whitespace"

• To specify a a shell or terminal command for the entire configuration file:

  __exec: "<string>"
  type: "yaml"
  trim: "none|whitespace"

  If specifying the entire configuration file via a terminal or shell command, the expansion directive and its options must be the only values specified in the configuration file.

__exec takes the following fields:

Field	Type	Description
__exec	string	Required The string which the mongod executes on the terminal or shell to retrieve the externally sourced value. On Linux and OSX hosts, execution is handled via POSIX popen(). On Windows hosts, execution is handled via the process control API. __exec opens a read-only pipe as the same user that started the mongod or mongos. IMPORTANT: The data returned by executing the specified command cannot include any additional expansion directives. The mongod does not perform additional processing on the returned data and will terminate with an error code if the returned data includes additional expansion directives.
type	string	Optional Controls how __exec parses the value returned by the executed command. Possible values are: string (Default ) Directs __exec to parse the returned data as a literal string. If specifying string, the entire __exec block and supporting options must be nested under the field for which you are loading externally sourced values. yaml Directs __exec to parse the returned data as a yaml formatted file. If specifying yaml, the __exec block must be the only content in the configuration file. The mongod replaces the configuration file contents with the yaml retrieved from the executed command.
trim	string	Optional Specify whitespace to direct __exec to trim any leading or trailing whitespace, specifically occurrences of " ", "\r", "\n", "\t", "\v", and "\f". Defaults to none, or no trimming.
digest	string	Optional. The SHA-256 digest of the expansion result. If specified, you must also specify the digest_key
digest_key	string	Optional. The hexadecimal string representation of the secret used to calculate the SHA-256 digest. If specified, you must also specify the digest

Note

• If the configuration file includes the __exec expansion, on Linux/macOS, the write access to the configuration file must be limited to the user running the mongod / mongos process only.

• To enable parsing of the __exec expansion directives, start the mongod with the --configExpand "exec" option.

For examples, see Use the __exec Expansion Directive.

Output the Configuration File with Resolved Expansion Directive Values

You can test the final output of a configuration file that specifies one or more expansion directives by starting the mongod with the --outputConfig option. A mongod started with --outputConfig outputs the resolved YAML configuration document to stdout and halts. If any expansion directive specified in the configuration file returns additional expansion directives, the mongod throws an error and terminates.

For example, the following configuration file mongod.conf contains a __rest expansion directive:

storage:
  dbPath: "/var/lib/mongo"
systemLog:
  destination: file
  path: "/var/log/mongodb/mongod.log"
net:
  port:
    __rest: "https://mongoconf.example.net:8080/record/1"
    type: string

The string recorded at the specified URL is 20128

If the configuration file includes the __rest expansion, on Linux/macOS, the read access to the configuration file must be limited to the user running the mongod / mongos process only.

Start the mongod with the --configExpand "rest" and --outputConfig options:

mongod -f mongod.conf --configExpand rest --outputConfig

The mongod outputs the following to stdout before terminating:

config: mongod.conf
storage:
  dbPath: "/var/lib/mongo"
systemLog:
  destination: file
  path: "/var/log/mongodb/mongod.log"
net:
  port: 20128
outputConfig: true