서비스 계정을 사용하여 Atlas에 대한 액세스 구성

Atlas에서 서비스 계정 만들기

Create a Service Account in Atlas using the Atlas UI or the Atlas Administration API. To learn how to create an organization-level Service Account, see Create a Service Account in an Organization. To learn how to create a project-level Service Account, see Create a Service Account in a Project.

clientId 및 clientSecret을(를) 복사합니다. 생성 후에는 clientSecret 를 다시 조회할 수 없으므로 안전하게 저장합니다.

Kubernetes 연결 시크릿 생성

Create a Kubernetes secret containing the orgId, clientId, and clientSecret.

• global Atlas Kubernetes Operator 시크릿의 경우 다음 명령을 실행 .

  참고

  The name of the global Atlas Kubernetes Operator secret must conform to the predefined format. The default name of the Atlas Kubernetes Operator deployment is mongodb-atlas-operator. So, the secret should be named mongodb-atlas-operator-service-account.

  kubectl create secret generic mongodb-atlas-operator-service-account \
     --from-literal="orgId=<the_atlas_organization_id>" \
     --from-literal="clientId=<the_service_account_client_id>" \
     --from-literal="clientSecret=<the_service_account_client_secret>" \
     -n <operator_namespace>
  kubectl label secret mongodb-atlas-operator-service-account \
     atlas.mongodb.com/type=credentials \
     -n mongodb-atlas-system

• project Atlas Kubernetes Operator 시크릿의 경우 다음 명령을 실행 .

  kubectl create secret generic my-project-connection \
     --from-literal="orgId=<the_atlas_organization_id>" \
     --from-literal="clientId=<the_service_account_client_id>" \
     --from-literal="clientSecret=<the_service_account_client_secret>" \
     -n <atlas_project_namespace>
  kubectl label secret my-project-connection \
     atlas.mongodb.com/type=credentials \
     -n <atlas_project_namespace>

시크릿에서 참조 AtlasProject

Reference the secret from your AtlasProject custom resource using spec.connectionSecretRef.name.

If you created a global secret, all projects use it by default and no additional configuration is needed.

If you created a project secret, add the connectionSecretRef to your AtlasProject custom resource:

apiVersion: atlas.mongodb.com/v1
kind: AtlasProject
metadata:
  name: my-project
spec:
  name: "My Project"
  connectionSecretRef:
    name: my-project-connection

연산자가 서비스 계정을 사용하는지 확인

After you configure the secret, verify that Atlas Kubernetes Operator authenticates successfully:

kubectl get atlasproject my-project -o jsonpath='{.status.conditions}'

Ready 조건이 True 인지 확인합니다. Atlas Kubernetes Operator가 Service Account 자격 증명으로 인증할 수 없으면 조건에 문제를 설명하는 오류가 표시됩니다.