멀티 클러스터 외부 애플리케이션 데이터베이스 배포

export K8S_CTX_0="<central-cluster-context>"export K8S_CTX_1="<member-cluster-1-context>"export K8S_CTX_2="<member-cluster-2-context>"export MDB_NS="mongodb"
export OPERATOR_HELM_CHART="oci://quay.io/mongodb/helm-charts/mongodb-kubernetes"
export OM_VERSION="8.0.7"export APPDB_VERSION="8.0.5-ent"
export MANAGEMENT_OM_NAME="management-om"export PRIMARY_OM_NAME="primary-om"
export APPDB_NAME="${PRIMARY_OM_NAME}-db"export APPDB_MEMBERS_C1=2export APPDB_MEMBERS_C2=2
export MANAGEMENT_OM_URL="http://${MANAGEMENT_OM_NAME}-svc.${MDB_NS}.svc.cluster.local:8080"export MANAGEMENT_OM_ADMIN_KEY_SECRET="${MDB_NS}-${MANAGEMENT_OM_NAME}-admin-key"
export APPDB_PROJECT_CONFIGMAP="${APPDB_NAME}-config"export APPDB_PROJECT_NAME="external-appdb"export APPDB_CONNECTION_STRING_SECRET="${APPDB_NAME}-connection-string"
export CERT_MANAGER_NAMESPACE="cert-manager"export APPDB_TLS_SELF_SIGNED_ISSUER="mongodb-self-signed-issuer"export APPDB_TLS_CA_CERT_NAME="mongodb-ca"export APPDB_TLS_CA_SECRET_NAME="mongodb-ca-key-pair"export APPDB_TLS_CA_ISSUER="mongodb-ca-issuer"export APPDB_CERT_PREFIX="appdb"export APPDB_CA_CONFIGMAP="${APPDB_NAME}-ca"
export OM_ADMIN_EMAIL="admin@example.com"export OM_ADMIN_PASSWORD="<your-password>"export OM_ADMIN_FIRST_NAME="Admin"export OM_ADMIN_LAST_NAME="User"

for ctx in "${K8S_CTX_0}" "${K8S_CTX_1}" "${K8S_CTX_2}"; do  kubectl create namespace "${MDB_NS}" --context "${ctx}" --dry-run=client -o yaml \    | kubectl apply --context "${ctx}" -f -  kubectl label namespace "${MDB_NS}" istio-injection=enabled --overwrite --context "${ctx}"done

kubectl mongodb multicluster setup \  --central-cluster="${K8S_CTX_0}" \  --member-clusters="${K8S_CTX_0},${K8S_CTX_1},${K8S_CTX_2}" \  --member-cluster-namespace="${MDB_NS}" \  --central-cluster-namespace="${MDB_NS}" \  --create-service-account-secrets \  --install-database-roles=true
helm upgrade --install --kube-context "${K8S_CTX_0}" \  --create-namespace --namespace "${MDB_NS}" \  mongodb-kubernetes-operator-multi-cluster \  --set operator.name=mongodb-kubernetes-operator-multi-cluster \  --set operator.createOperatorServiceAccount=false \  --set operator.createResourcesServiceAccountsAndRoles=false \  --set "multiCluster.clusters={${K8S_CTX_0},${K8S_CTX_1},${K8S_CTX_2}}" \  "${OPERATOR_HELM_CHART}"
kubectl rollout status deployment/mongodb-kubernetes-operator-multi-cluster \  --context "${K8S_CTX_0}" -n "${MDB_NS}" --timeout=300s

kubectl create secret generic ops-manager-admin-secret \  --context "${K8S_CTX_0}" -n "${MDB_NS}" \  --from-literal=Username="${OM_ADMIN_EMAIL}" \  --from-literal=Password="${OM_ADMIN_PASSWORD}" \  --from-literal=FirstName="${OM_ADMIN_FIRST_NAME}" \  --from-literal=LastName="${OM_ADMIN_LAST_NAME}"

helm upgrade --install --kube-context "${K8S_CTX_0}" \  cert-manager jetstack/cert-manager \  --namespace "${CERT_MANAGER_NAMESPACE}" --create-namespace \  --set crds.enabled=true

kubectl apply --context "${K8S_CTX_0}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata:  name: ${APPDB_TLS_SELF_SIGNED_ISSUER}spec:  selfSigned: {}EOF
kubectl apply --context "${K8S_CTX_0}" -n "${CERT_MANAGER_NAMESPACE}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata:  name: ${APPDB_TLS_CA_CERT_NAME}spec:  isCA: true  commonName: mongodb-ca  secretName: ${APPDB_TLS_CA_SECRET_NAME}  duration: 87600h  renewBefore: 8760h  privateKey:    algorithm: ECDSA    size: 256  issuerRef:    name: ${APPDB_TLS_SELF_SIGNED_ISSUER}    kind: ClusterIssuerEOF
kubectl wait --for=condition=Ready certificate/"${APPDB_TLS_CA_CERT_NAME}" \  -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX_0}" --timeout=120s
kubectl apply --context "${K8S_CTX_0}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata:  name: ${APPDB_TLS_CA_ISSUER}spec:  ca:    secretName: ${APPDB_TLS_CA_SECRET_NAME}EOF
ca_crt=$(kubectl get secret "${APPDB_TLS_CA_SECRET_NAME}" \  -n "${CERT_MANAGER_NAMESPACE}" --context "${K8S_CTX_0}" \  -o jsonpath='{.data.ca\.crt}' | base64 -d)
system_ca=""for candidate in /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt /etc/ssl/cert.pem; do  [[ -r "${candidate}" ]] && { system_ca=$(cat "${candidate}"); break; }done
ca_bundle_file=$(mktemp)printf '%s\n%s\n' "${ca_crt}" "${system_ca}" > "${ca_bundle_file}"
kubectl create configmap "${APPDB_CA_CONFIGMAP}" \  --context "${K8S_CTX_0}" -n "${MDB_NS}" \  --from-file=ca-pem="${ca_bundle_file}" \  --from-file=mms-ca.crt="${ca_bundle_file}" \  --dry-run=client -o yaml \  | kubectl apply --server-side --force-conflicts --context "${K8S_CTX_0}" -n "${MDB_NS}" -f -
rm -f "${ca_bundle_file}"

kubectl apply --context "${K8S_CTX_0}" -n "${MDB_NS}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata:  name: ${APPDB_CERT_PREFIX}-${APPDB_NAME}-certspec:  secretName: ${APPDB_CERT_PREFIX}-${APPDB_NAME}-cert  duration: 8760h  renewBefore: 720h  privateKey:    algorithm: RSA    size: 2048  usages: ["server auth", "client auth"]  dnsNames:    - "*.${MDB_NS}.svc.cluster.local"  issuerRef:    name: ${APPDB_TLS_CA_ISSUER}    kind: ClusterIssuerEOF
kubectl wait --for=condition=Ready certificate/"${APPDB_CERT_PREFIX}-${APPDB_NAME}-cert" \  -n "${MDB_NS}" --context "${K8S_CTX_0}" --timeout=120s

kubectl apply --context "${K8S_CTX_0}" -n "${MDB_NS}" -f - <<EOFapiVersion: mongodb.com/v1kind: MongoDBOpsManagermetadata:  name: ${MANAGEMENT_OM_NAME}spec:  replicas: 1  version: ${OM_VERSION}  adminCredentials: ops-manager-admin-secret  applicationDatabase:    members: 3    version: ${APPDB_VERSION}  backup:    enabled: false  configuration:    automation.versions.source: mongodb    mms.ignoreInitialUiSetup: "true"    mms.adminEmailAddr: admin@example.com    mms.fromEmailAddr: admin@example.com    mms.replyToEmailAddr: admin@example.com    mms.mail.hostname: email-smtp.us-east-1.amazonaws.com    mms.mail.port: "465"    mms.mail.ssl: "true"    mms.mail.transport: smtp    mms.minimumTLSVersion: TLSv1.2EOF

kubectl create configmap "${APPDB_PROJECT_CONFIGMAP}" \  --context "${K8S_CTX_0}" -n "${MDB_NS}" \  --from-literal=baseUrl="${MANAGEMENT_OM_URL}" \  --from-literal=projectName="${APPDB_PROJECT_NAME}" \  --from-literal=sslMMSCAConfigMap="${APPDB_CA_CONFIGMAP}" \  --from-literal=orgId="" \  --dry-run=client -o yaml \  | kubectl apply --context "${K8S_CTX_0}" -n "${MDB_NS}" -f -

kubectl apply --context "${K8S_CTX_0}" -n "${MDB_NS}" -f - <<EOFapiVersion: mongodb.com/v1kind: MongoDBMultiClustermetadata:  name: ${APPDB_NAME}spec:  version: ${APPDB_VERSION}  type: ReplicaSet  role: AppDB  persistent: true  credentials: ${MANAGEMENT_OM_ADMIN_KEY_SECRET}  opsManager:    configMapRef:      name: ${APPDB_PROJECT_CONFIGMAP}  security:    certsSecretPrefix: ${APPDB_CERT_PREFIX}    tls:      enabled: true      ca: ${APPDB_CA_CONFIGMAP}  clusterSpecList:    - clusterName: ${K8S_CTX_1}      members: ${APPDB_MEMBERS_C1}    - clusterName: ${K8S_CTX_2}      members: ${APPDB_MEMBERS_C2}EOF
kubectl wait --for=jsonpath='{.status.phase}'=Running \  mdbmc/"${APPDB_NAME}" --context "${K8S_CTX_0}" -n "${MDB_NS}" --timeout=1200s

kubectl apply --context "${K8S_CTX_0}" -n "${MDB_NS}" -f - <<EOFapiVersion: mongodb.com/v1kind: MongoDBOpsManagermetadata:  name: ${PRIMARY_OM_NAME}spec:  replicas: 1  version: ${OM_VERSION}  adminCredentials: ops-manager-admin-secret  externalApplicationDatabaseRef:    name: ${APPDB_NAME}    kind: MongoDBMultiCluster  backup:    enabled: false  configuration:    automation.versions.source: mongodb    mms.ignoreInitialUiSetup: "true"    mms.adminEmailAddr: admin@example.com    mms.fromEmailAddr: admin@example.com    mms.replyToEmailAddr: admin@example.com    mms.mail.hostname: email-smtp.us-east-1.amazonaws.com    mms.mail.port: "465"    mms.mail.ssl: "true"    mms.mail.transport: smtp    mms.minimumTLSVersion: TLSv1.2EOF

kubectl wait --for=jsonpath='{.status.opsManager.phase}'=Running \  om/"${PRIMARY_OM_NAME}" --context "${K8S_CTX_0}" -n "${MDB_NS}" --timeout=1800s
kubectl wait --for=jsonpath='{.status.applicationDatabase.phase}'=Disabled \  om/"${PRIMARY_OM_NAME}" --context "${K8S_CTX_0}" -n "${MDB_NS}" --timeout=600s