Docs Menu
Docs Home
/ /
검색 배포 및 벡터 검색
Docs Home
/
관리
/
Kubernetes Operator용 컨트롤러
/
검색 배포 및 벡터 검색
Docs Home
/
관리
/
Kubernetes Operator용 컨트롤러
/
검색 배포 및 벡터 검색

MongoDB Community Edition 과 함께 설치 및 사용

Kubernetes Operator를 사용하고 mongot 프로세스 리소스를 배포 Kubernetes 클러스터 에서 MongoDB Community Edition v8.2.0 이상으로 실행 수 있습니다. mongot 프로세스 MongoDB Search 검색 Vector Search를 모두 지원합니다. 다음 절차는 Kubernetes 클러스터 의 신규 또는 기존 복제본 세트 와 함께 실행 되도록 MongoDB Search 및 벡터 검색을 배포 하고 구성하는 방법을 보여줍니다. 배포서버 TLS 인증서를 사용하여 MongoDB 노드와 mongot 검색 프로세스 간의 보안 통신을 보장합니다.

전제 조건

MongoDB Search 및 Vector Search를 배포 하려면 다음이 필요합니다.

  • 실행 중인 Kubernetes 클러스터.

  • Kubernetes 명령줄 도구인 kubectl이(가) 클러스터 와 통신하도록 구성되었습니다.

  • Kubernetes 용 패키지 관리자인Helm을 사용하여 Kubernetes Operator를 설치합니다.

  • cert-manager 또는 TLS 인증서 프로비저닝 위한 대체 인증서 관리 솔루션입니다.

  • 이 튜토리얼의 명령을 실행 하려면 Bash v5.1 이상을 사용해야 합니다.

절차

1

필수 사항입니다. 환경 변수를 설정합니다.

이 절차의 후속 단계에서 사용할 환경 변수를 설정합니다. 다음 명령을 복사하여 환경에 맞는 값을 업데이트 다음, 이를 실행 변수를 로드합니다.

1# set it to the context name of the k8s cluster
2export K8S_CTX="<local cluster context>"
3
4# the following namespace will be created if not exists
5export MDB_NS="mongodb"
6
7# MongoDBCommunity resource name referenced throughout the guide
8export MDB_RESOURCE_NAME="mdbc-rs"
9# Number of replica set members deployed in the sample MongoDBCommunity
10export MDB_MEMBERS=3
11
12# TLS-related secret names used for MongoDBCommunity and MongoDBSearch
13export MDB_TLS_CA_SECRET_NAME="${MDB_RESOURCE_NAME}-ca"
14export MDB_TLS_SERVER_CERT_SECRET_NAME="${MDB_RESOURCE_NAME}-tls"
15export MDB_SEARCH_TLS_SECRET_NAME="${MDB_RESOURCE_NAME}-search-tls"
16
17export MDB_TLS_CA_CONFIGMAP="${MDB_RESOURCE_NAME}-ca-configmap"
18export MDB_TLS_SELF_SIGNED_ISSUER="${MDB_RESOURCE_NAME}-selfsigned-cluster-issuer"
19export MDB_TLS_CA_CERT_NAME="${MDB_RESOURCE_NAME}-selfsigned-ca"
20export MDB_TLS_CA_ISSUER="${MDB_RESOURCE_NAME}-cluster-issuer"
21
22# minimum required MongoDB version for running MongoDB Search is 8.2.0
23export MDB_VERSION="8.2.0"
24
25# root admin user for convenience, not used here at all in this guide
26export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
27# regular user performing restore and search queries on sample mflix database
28export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
29# user for MongoDB Search to connect to the replica set to synchronise data from
30export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
31
32export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes"
33# comma-separated key=value pairs for additional parameters passed to the helm-chart installing the operator
34export OPERATOR_ADDITIONAL_HELM_VALUES=""
35
36# TLS is mandatory; connection string must include tls=true
37export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_RESOURCE_NAME}-0.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local:27017/?replicaSet=${MDB_RESOURCE_NAME}&tls=true&tlsCAFile=/tls/ca.crt"
38
39export CERT_MANAGER_NAMESPACE="cert-manager"
2

조건부. MongoDB Helm 리포지토리 추가합니다.

Helm 은 Kubernetes 에서 MongoDB 인스턴스의 배포서버 및 관리 자동화합니다. Kubernetes 연산자 연산자 설치를 위한 Helm 차트 포함된 Helm 리포지토리 이미 있는 경우 이 단계를 건너뛰세요. 그렇지 않으면 Helm 리포지토리 추가합니다.

Helm 리포지토리 추가하려면 다음을 복사하여 붙여넣고 실행 .

1helm repo add mongodb https://mongodb.github.io/helm-charts
2helm repo update mongodb
3helm search repo mongodb/mongodb-kubernetes
1"mongodb" has been added to your repositories
2Hang tight while we grab the latest from your chart repositories...
3...Successfully got an update from the "mongodb" chart repository
4Update Complete. ⎈Happy Helming!⎈
5NAME                      	CHART VERSION	APP VERSION	DESCRIPTION                                       
6mongodb/mongodb-kubernetes	1.6.1        	           	MongoDB Controllers for Kubernetes translate th...
3

조건부. Kubernetes Operator용 MongoDB 컨트롤러를 설치합니다.

Kubernetes 연산자는 MongoDBCommunity 및 MongoDBSearch 사용자 지정 리소스를 감시하고 MongoDB 배포의 수명 주기를 관리합니다. Kubernetes 연산자용 MongoDB 컨트롤러를 이미 설치한 경우 이 단계를 건너뛰세요. 그렇지 않으면 이전 단계에서 추가한 Helm 리포지토리 에서 Kubernetes 연산자용 MongoDB 컨트롤러를 설치합니다.

mongodb 네임스페이스 에 Kubernetes Operator용 MongoDB 컨트롤러를 설치하려면 다음 명령을 복사하여 붙여넣고 실행 .

1helm upgrade --install --debug --kube-context "${K8S_CTX}" \
2  --create-namespace \
3  --namespace="${MDB_NS}" \
4  mongodb-kubernetes \
5  ${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
6  "${OPERATOR_HELM_CHART}"
1Release "mongodb-kubernetes" does not exist. Installing it now.
2NAME: mongodb-kubernetes
3LAST DEPLOYED: Wed Dec 17 11:22:40 2025
4NAMESPACE: mongodb
5STATUS: deployed
6REVISION: 1
7TEST SUITE: None
8USER-SUPPLIED VALUES:
9{}
10
11COMPUTED VALUES:
12agent:
13  name: mongodb-agent
14  version: 108.0.12.8846-1
15community:
16  agent:
17    name: mongodb-agent
18    version: 108.0.2.8729-1
19  mongodb:
20    imageType: ubi8
21    name: mongodb-community-server
22    repo: quay.io/mongodb
23  registry:
24    agent: quay.io/mongodb
25  resource:
26    members: 3
27    name: mongodb-replica-set
28    tls:
29      caCertificateSecretRef: tls-ca-key-pair
30      certManager:
31        certDuration: 8760h
32        renewCertBefore: 720h
33      certificateKeySecretRef: tls-certificate
34      enabled: false
35      sampleX509User: false
36      useCertManager: true
37      useX509: false
38    version: 4.4.0
39database:
40  name: mongodb-kubernetes-database
41  version: 1.6.1
42initAppDb:
43  name: mongodb-kubernetes-init-appdb
44  version: 1.6.1
45initDatabase:
46  name: mongodb-kubernetes-init-database
47  version: 1.6.1
48initOpsManager:
49  name: mongodb-kubernetes-init-ops-manager
50  version: 1.6.1
51managedSecurityContext: false
52mongodb:
53  appdbAssumeOldFormat: false
54  name: mongodb-enterprise-server
55  repo: quay.io/mongodb
56multiCluster:
57  clusterClientTimeout: 10
58  clusters: []
59  kubeConfigSecretName: mongodb-enterprise-operator-multi-cluster-kubeconfig
60  performFailOver: true
61operator:
62  additionalArguments: []
63  affinity: {}
64  baseName: mongodb-kubernetes
65  createOperatorServiceAccount: true
66  createResourcesServiceAccountsAndRoles: true
67  deployment_name: mongodb-kubernetes-operator
68  enableClusterMongoDBRoles: true
69  enablePVCResize: true
70  env: prod
71  maxConcurrentReconciles: 1
72  mdbDefaultArchitecture: non-static
73  name: mongodb-kubernetes-operator
74  nodeSelector: {}
75  operator_image_name: mongodb-kubernetes
76  podSecurityContext:
77    runAsNonRoot: true
78    runAsUser: 2000
79  replicas: 1
80  resources:
81    limits:
82      cpu: 1100m
83      memory: 1Gi
84    requests:
85      cpu: 500m
86      memory: 200Mi
87  securityContext: {}
88  telemetry:
89    collection:
90      clusters: {}
91      deployments: {}
92      frequency: 1h
93      operators: {}
94    send:
95      frequency: 168h
96  tolerations: []
97  vaultSecretBackend:
98    enabled: false
99    tlsSecretRef: ""
100  version: 1.6.1
101  watchedResources:
102  - mongodb
103  - opsmanagers
104  - mongodbusers
105  - mongodbcommunity
106  - mongodbsearch
107  webhook:
108    installClusterRole: true
109    registerConfiguration: true
110opsManager:
111  name: mongodb-enterprise-ops-manager-ubi
112readinessProbe:
113  name: mongodb-kubernetes-readinessprobe
114  version: 1.0.23
115registry:
116  agent: quay.io/mongodb
117  database: quay.io/mongodb
118  imagePullSecrets: null
119  initAppDb: quay.io/mongodb
120  initDatabase: quay.io/mongodb
121  initOpsManager: quay.io/mongodb
122  operator: quay.io/mongodb
123  opsManager: quay.io/mongodb
124  pullPolicy: Always
125  readinessProbe: quay.io/mongodb
126  versionUpgradeHook: quay.io/mongodb
127search:
128  name: mongodb-search
129  repo: quay.io/mongodb
130  version: 0.55.0
131versionUpgradeHook:
132  name: mongodb-kubernetes-operator-version-upgrade-post-start-hook
133  version: 1.0.10
134
135HOOKS:
136MANIFEST:
137---
138# Source: mongodb-kubernetes/templates/database-roles.yaml
139apiVersion: v1
140kind: ServiceAccount
141metadata:
142  name: mongodb-kubernetes-appdb
143  namespace: mongodb
144---
145# Source: mongodb-kubernetes/templates/database-roles.yaml
146apiVersion: v1
147kind: ServiceAccount
148metadata:
149  name: mongodb-kubernetes-database-pods
150  namespace: mongodb
151---
152# Source: mongodb-kubernetes/templates/database-roles.yaml
153apiVersion: v1
154kind: ServiceAccount
155metadata:
156  name: mongodb-kubernetes-ops-manager
157  namespace: mongodb
158---
159# Source: mongodb-kubernetes/templates/operator-sa.yaml
160apiVersion: v1
161kind: ServiceAccount
162metadata:
163  name: mongodb-kubernetes-operator
164  namespace: mongodb
165---
166# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
167kind: ClusterRole
168apiVersion: rbac.authorization.k8s.io/v1
169metadata:
170  name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
171rules:
172  - apiGroups:
173      - mongodb.com
174    verbs:
175      - '*'
176    resources:
177      - clustermongodbroles
178---
179# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
180# Additional ClusterRole for clusterVersionDetection
181kind: ClusterRole
182apiVersion: rbac.authorization.k8s.io/v1
183metadata:
184  name: mongodb-kubernetes-operator-cluster-telemetry
185rules:
186  # Non-resource URL permissions
187  - nonResourceURLs:
188      - "/version"
189    verbs:
190      - get
191  # Cluster-scoped resource permissions
192  - apiGroups:
193      - ''
194    resources:
195      - namespaces
196    resourceNames:
197      - kube-system
198    verbs:
199      - get
200  - apiGroups:
201      - ''
202    resources:
203      - nodes
204    verbs:
205      - list
206---
207# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
208kind: ClusterRole
209apiVersion: rbac.authorization.k8s.io/v1
210metadata:
211  name: mongodb-kubernetes-operator-mongodb-webhook-cr
212rules:
213  - apiGroups:
214      - "admissionregistration.k8s.io"
215    resources:
216      - validatingwebhookconfigurations
217    verbs:
218      - get
219      - create
220      - update
221      - delete
222  - apiGroups:
223      - ""
224    resources:
225      - services
226    verbs:
227      - get
228      - list
229      - watch
230      - create
231      - update
232      - delete
233---
234# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
235kind: ClusterRoleBinding
236apiVersion: rbac.authorization.k8s.io/v1
237metadata:
238  name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
239roleRef:
240  apiGroup: rbac.authorization.k8s.io
241  kind: ClusterRole
242  name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
243subjects:
244  - kind: ServiceAccount
245    name: mongodb-kubernetes-operator
246    namespace: mongodb
247---
248# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
249# ClusterRoleBinding for clusterVersionDetection
250kind: ClusterRoleBinding
251apiVersion: rbac.authorization.k8s.io/v1
252metadata:
253  name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
254roleRef:
255  apiGroup: rbac.authorization.k8s.io
256  kind: ClusterRole
257  name: mongodb-kubernetes-operator-cluster-telemetry
258subjects:
259  - kind: ServiceAccount
260    name: mongodb-kubernetes-operator
261    namespace: mongodb
262---
263# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
264kind: ClusterRoleBinding
265apiVersion: rbac.authorization.k8s.io/v1
266metadata:
267  name: mongodb-kubernetes-operator-mongodb-webhook-crb
268roleRef:
269  apiGroup: rbac.authorization.k8s.io
270  kind: ClusterRole
271  name: mongodb-kubernetes-operator-mongodb-webhook-cr
272subjects:
273  - kind: ServiceAccount
274    name: mongodb-kubernetes-operator
275    namespace: mongodb
276---
277# Source: mongodb-kubernetes/templates/database-roles.yaml
278kind: Role
279apiVersion: rbac.authorization.k8s.io/v1
280metadata:
281  name: mongodb-kubernetes-appdb
282  namespace: mongodb
283rules:
284  - apiGroups:
285      - ''
286    resources:
287      - secrets
288    verbs:
289      - get
290  - apiGroups:
291      - ''
292    resources:
293      - pods
294    verbs:
295      - patch
296      - delete
297      - get
298---
299# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
300kind: Role
301apiVersion: rbac.authorization.k8s.io/v1
302metadata:
303  name: mongodb-kubernetes-operator
304  namespace: mongodb
305rules:
306  - apiGroups:
307      - ''
308    resources:
309      - services
310    verbs:
311      - get
312      - list
313      - watch
314      - create
315      - update
316      - delete
317  - apiGroups:
318      - ''
319    resources:
320      - secrets
321      - configmaps
322    verbs:
323      - get
324      - list
325      - create
326      - update
327      - delete
328      - watch
329  - apiGroups:
330      - apps
331    resources:
332      - statefulsets
333    verbs:
334      - create
335      - get
336      - list
337      - watch
338      - delete
339      - update
340  - apiGroups:
341      - ''
342    resources:
343      - pods
344    verbs:
345      - get
346      - list
347      - watch
348      - delete
349      - deletecollection
350  - apiGroups:
351      - mongodbcommunity.mongodb.com
352    resources:
353      - mongodbcommunity
354      - mongodbcommunity/status
355      - mongodbcommunity/spec
356      - mongodbcommunity/finalizers
357    verbs:
358      - '*'
359  - apiGroups:
360      - mongodb.com
361    verbs:
362      - '*'
363    resources:
364      - mongodb
365      - mongodb/finalizers
366      - mongodbusers
367      - mongodbusers/finalizers
368      - opsmanagers
369      - opsmanagers/finalizers
370      - mongodbmulticluster
371      - mongodbmulticluster/finalizers
372      - mongodbsearch
373      - mongodbsearch/finalizers
374      - mongodb/status
375      - mongodbusers/status
376      - opsmanagers/status
377      - mongodbmulticluster/status
378      - mongodbsearch/status
379---
380# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
381kind: Role
382apiVersion: rbac.authorization.k8s.io/v1
383metadata:
384  name: mongodb-kubernetes-operator-pvc-resize
385  namespace: mongodb
386rules:
387  - apiGroups:
388      - ''
389    resources:
390      - persistentvolumeclaims
391    verbs:
392      - get
393      - delete
394      - list
395      - watch
396      - patch
397      - update
398---
399# Source: mongodb-kubernetes/templates/database-roles.yaml
400kind: RoleBinding
401apiVersion: rbac.authorization.k8s.io/v1
402metadata:
403  name: mongodb-kubernetes-appdb
404  namespace: mongodb
405roleRef:
406  apiGroup: rbac.authorization.k8s.io
407  kind: Role
408  name: mongodb-kubernetes-appdb
409subjects:
410  - kind: ServiceAccount
411    name: mongodb-kubernetes-appdb
412    namespace: mongodb
413---
414# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
415kind: RoleBinding
416apiVersion: rbac.authorization.k8s.io/v1
417metadata:
418  name: mongodb-kubernetes-operator
419  namespace: mongodb
420roleRef:
421  apiGroup: rbac.authorization.k8s.io
422  kind: Role
423  name: mongodb-kubernetes-operator
424subjects:
425  - kind: ServiceAccount
426    name: mongodb-kubernetes-operator
427    namespace: mongodb
428---
429# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
430kind: RoleBinding
431apiVersion: rbac.authorization.k8s.io/v1
432metadata:
433  name: mongodb-kubernetes-operator-pvc-resize-binding
434  namespace: mongodb
435roleRef:
436  apiGroup: rbac.authorization.k8s.io
437  kind: Role
438  name: mongodb-kubernetes-operator-pvc-resize
439subjects:
440  - kind: ServiceAccount
441    name: mongodb-kubernetes-operator
442    namespace: mongodb
443---
444# Source: mongodb-kubernetes/templates/operator.yaml
445apiVersion: apps/v1
446kind: Deployment
447metadata:
448  name: mongodb-kubernetes-operator
449  namespace: mongodb
450spec:
451  replicas: 1
452  selector:
453    matchLabels:
454      app.kubernetes.io/component: controller
455      app.kubernetes.io/name: mongodb-kubernetes-operator
456      app.kubernetes.io/instance: mongodb-kubernetes-operator
457  template:
458    metadata:
459      labels:
460        app.kubernetes.io/component: controller
461        app.kubernetes.io/name: mongodb-kubernetes-operator
462        app.kubernetes.io/instance: mongodb-kubernetes-operator
463    spec:
464      serviceAccountName: mongodb-kubernetes-operator
465      securityContext:
466        runAsNonRoot: true
467        runAsUser: 2000
468      containers:
469        - name: mongodb-kubernetes-operator
470          image: "quay.io/mongodb/mongodb-kubernetes:1.6.1"
471          imagePullPolicy: Always
472          args:
473            - -watch-resource=mongodb
474            - -watch-resource=opsmanagers
475            - -watch-resource=mongodbusers
476            - -watch-resource=mongodbcommunity
477            - -watch-resource=mongodbsearch
478            - -watch-resource=clustermongodbroles
479          command:
480            - /usr/local/bin/mongodb-kubernetes-operator
481          resources:
482            limits:
483              cpu: 1100m
484              memory: 1Gi
485            requests:
486              cpu: 500m
487              memory: 200Mi
488          env:
489            - name: OPERATOR_ENV
490              value: prod
491            - name: MDB_DEFAULT_ARCHITECTURE
492              value: non-static
493            - name: NAMESPACE
494              valueFrom:
495                fieldRef:
496                  fieldPath: metadata.namespace
497            - name: WATCH_NAMESPACE
498              valueFrom:
499                fieldRef:
500                  fieldPath: metadata.namespace
501            - name: MDB_OPERATOR_TELEMETRY_COLLECTION_FREQUENCY
502              value: "1h"
503            - name: MDB_OPERATOR_TELEMETRY_SEND_FREQUENCY
504              value: "168h"
505            - name: CLUSTER_CLIENT_TIMEOUT
506              value: "10"
507            - name: IMAGE_PULL_POLICY
508              value: Always
509            # Database
510            - name: MONGODB_ENTERPRISE_DATABASE_IMAGE
511              value: quay.io/mongodb/mongodb-kubernetes-database
512            - name: INIT_DATABASE_IMAGE_REPOSITORY
513              value: quay.io/mongodb/mongodb-kubernetes-init-database
514            - name: INIT_DATABASE_VERSION
515              value: "1.6.1"
516            - name: DATABASE_VERSION
517              value: "1.6.1"
518            # Ops Manager
519            - name: OPS_MANAGER_IMAGE_REPOSITORY
520              value: quay.io/mongodb/mongodb-enterprise-ops-manager-ubi
521            - name: INIT_OPS_MANAGER_IMAGE_REPOSITORY
522              value: quay.io/mongodb/mongodb-kubernetes-init-ops-manager
523            - name: INIT_OPS_MANAGER_VERSION
524              value: "1.6.1"
525            # AppDB
526            - name: INIT_APPDB_IMAGE_REPOSITORY
527              value: quay.io/mongodb/mongodb-kubernetes-init-appdb
528            - name: INIT_APPDB_VERSION
529              value: "1.6.1"
530            - name: OPS_MANAGER_IMAGE_PULL_POLICY
531              value: Always
532            - name: AGENT_IMAGE
533              value: "quay.io/mongodb/mongodb-agent:108.0.12.8846-1"
534            - name: MDB_AGENT_IMAGE_REPOSITORY
535              value: "quay.io/mongodb/mongodb-agent"
536            - name: MONGODB_IMAGE
537              value: mongodb-enterprise-server
538            - name: MONGODB_REPO_URL
539              value: quay.io/mongodb
540            - name: PERFORM_FAILOVER
541              value: 'true'
542            - name: MDB_MAX_CONCURRENT_RECONCILES
543              value: "1"
544            - name: POD_NAME
545              valueFrom:
546                fieldRef:
547                  fieldPath: metadata.name
548            - name: OPERATOR_NAME
549              value: mongodb-kubernetes-operator
550            # Community Env Vars Start
551            - name: MDB_COMMUNITY_AGENT_IMAGE
552              value: "quay.io/mongodb/mongodb-agent:108.0.2.8729-1"
553            - name: VERSION_UPGRADE_HOOK_IMAGE
554              value: "quay.io/mongodb/mongodb-kubernetes-operator-version-upgrade-post-start-hook:1.0.10"
555            - name: READINESS_PROBE_IMAGE
556              value: "quay.io/mongodb/mongodb-kubernetes-readinessprobe:1.0.23"
557            - name: MDB_COMMUNITY_IMAGE
558              value: "mongodb-community-server"
559            - name: MDB_COMMUNITY_REPO_URL
560              value: "quay.io/mongodb"
561            - name: MDB_COMMUNITY_IMAGE_TYPE
562              value: "ubi8"
563            # Community Env Vars End
564            - name: MDB_SEARCH_REPO_URL
565              value: "quay.io/mongodb"
566            - name: MDB_SEARCH_NAME
567              value: "mongodb-search"
568            - name: MDB_SEARCH_VERSION
569              value: "0.55.0"
4

선택 사항. 연산자 배포서버 기다립니다.

MongoDB Search 및 Vector Search 배포서버 진행하기 전에 Kubernetes Operator가 완전히 작동하는지 확인합니다. 다음 명령을 실행하여 모든 연산자 구성 요소가 실행 중이고 사용 가능한지 확인합니다.

1kubectl --context "${K8S_CTX}" -n "${MDB_NS}" rollout status --timeout=2m deployment/mongodb-kubernetes-operator
2echo "Operator deployment in ${MDB_NS} namespace"
3kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get deployments
4echo; echo "Operator pod in ${MDB_NS} namespace"
5kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
1Waiting for deployment "mongodb-kubernetes-operator" rollout to finish: 0 of 1 updated replicas are available...
2deployment "mongodb-kubernetes-operator" successfully rolled out
3Operator deployment in mongodb namespace
4NAME                          READY   UP-TO-DATE   AVAILABLE   AGE
5mongodb-kubernetes-operator   1/1     1            1           4s
6
7Operator pod in mongodb namespace
8NAME                                           READY   STATUS    RESTARTS   AGE
9mongodb-kubernetes-operator-7bd6cdd889-v8l9n   1/1     Running   0          4s
5

필수입니다. MongoDB 사용자 시크릿을 생성하고 로드합니다.

MongoDB 보안 액세스 위해 인증 필요합니다. 이 단계에서는 세 개의 Kubernetes 시크릿을 생성합니다.

  • mdb-admin-user-password: MongoDB 관리자의 자격 증명입니다.

  • mdb-user-password: 검색 쿼리를 수행할 수 있는 권한이 있는 사용자의 자격 증명입니다.

  • mdbc-rs-search-sync-source-password: mongot 프로세스 에서 데이터를 동기화하고 인덱스를 관리 위해 내부적으로 사용하는 검색 전용 사용자에 대한 자격 증명입니다.

Kubernetes Operator는 해당 시크릿의 비밀번호를 사용하여 MongoDB database 에 사용자를 자동으로 생성합니다.

시크릿을 생성하려면 다음 명령을 복사하여 붙여넣고 실행 .

1# Create admin user secret
2kubectl create secret generic mdb-admin-user-password \
3  --from-literal=password="${MDB_ADMIN_USER_PASSWORD}" \
4  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
5
6# Create search sync source user secret
7kubectl create secret generic "${MDB_RESOURCE_NAME}-search-sync-source-password" \
8  --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}" \
9  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
10
11# Create regular user secret
12kubectl create secret generic mdb-user-password \
13  --from-literal=password="${MDB_USER_PASSWORD}" \
14  --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f -
15
16echo "User secrets created."
1secret/mdb-admin-user-password created
2secret/mdbc-rs-search-sync-source-password created
3secret/mdb-user-password created
6

조건부. 을(를) cert-manager 설치합니다.

TLS 인증서를 관리하려면 cert-manager 이(가) 필요합니다. 클러스터 에 cert-manager 이(가) 이미 설치되어 있는 경우 이 단계를 건너뛰세요. 그렇지 않으면 Helm을 사용하여 cert-manager 를 설치합니다.

cert-manager 네임스페이스 에 cert-manager 를 설치하려면 터미널에서 다음 명령을 실행 .

1helm upgrade --install \
2  cert-manager \
3  oci://quay.io/jetstack/charts/cert-manager \
4  --kube-context "${K8S_CTX}" \
5  --namespace "${CERT_MANAGER_NAMESPACE}" \
6  --create-namespace \
7  --set crds.enabled=true
8
9for deployment in cert-manager cert-manager-cainjector cert-manager-webhook; do
10  kubectl --context "${K8S_CTX}" \
11    -n "${CERT_MANAGER_NAMESPACE}" \
12    wait --for=condition=Available "deployment/${deployment}" --timeout=300s
13done
14
15echo "cert-manager is ready in namespace ${CERT_MANAGER_NAMESPACE}."
7

필수입니다. 인증서 발급자 및 CA 인프라를 준비합니다.

MongoDB 및 MongoDBSearch 리소스에 대한 TLS 인증서를 발급할 인증 기관 인프라를 생성합니다. 이 명령은 다음 조치를 수행합니다.

  • 자체 서명된 ClusterIssuer을 만듭니다.

  • CA 인증서를 생성합니다.

  • 모든 네임스페이스가 사용할 수 있는 클러스터 전체 CA 발급자를 게시합니다.

  • MongoDB 리소스가 사용할 수 있도록 ConfigMap 를 통해 CA 번들을 노출합니다.

1# Bootstrap a self-signed ClusterIssuer that will mint the CA material consumed by
2# the MongoDBCommunity deployment.
3kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST
4apiVersion: cert-manager.io/v1
5kind: ClusterIssuer
6metadata:
7  name: ${MDB_TLS_SELF_SIGNED_ISSUER}
8spec:
9  selfSigned: {}
10EOF_MANIFEST
11
12kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_SELF_SIGNED_ISSUER}"
13
14# Create the CA certificate and secret in the cert-manager namespace.
15kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST
16apiVersion: cert-manager.io/v1
17kind: Certificate
18metadata:
19  name: ${MDB_TLS_CA_CERT_NAME}
20  namespace: ${CERT_MANAGER_NAMESPACE}
21spec:
22  isCA: true
23  commonName: ${MDB_TLS_CA_CERT_NAME}
24  secretName: ${MDB_TLS_CA_SECRET_NAME}
25  privateKey:
26    algorithm: ECDSA
27    size: 256
28  issuerRef:
29    name: ${MDB_TLS_SELF_SIGNED_ISSUER}
30    kind: ClusterIssuer
31EOF_MANIFEST
32
33kubectl --context "${K8S_CTX}" wait --for=condition=Ready -n "${CERT_MANAGER_NAMESPACE}" certificate "${MDB_TLS_CA_CERT_NAME}"
34
35# Publish a cluster-scoped issuer that fronts the generated CA secret so all namespaces can reuse it.
36kubectl apply --context "${K8S_CTX}" -f - <<EOF_MANIFEST
37apiVersion: cert-manager.io/v1
38kind: ClusterIssuer
39metadata:
40  name: ${MDB_TLS_CA_ISSUER}
41spec:
42  ca:
43    secretName: ${MDB_TLS_CA_SECRET_NAME}
44EOF_MANIFEST
45
46kubectl --context "${K8S_CTX}" wait --for=condition=Ready clusterissuer "${MDB_TLS_CA_ISSUER}"
47
48TMP_CA_CERT="$(mktemp)"
49
50kubectl --context "${K8S_CTX}" \
51  get secret "${MDB_TLS_CA_SECRET_NAME}" -n "${CERT_MANAGER_NAMESPACE}" \
52  -o jsonpath="{.data['ca\\.crt']}" | base64 --decode > "${TMP_CA_CERT}"
53
54# Expose the CA bundle through a ConfigMap for workloads and the MongoDBCommunity resource.
55kubectl --context "${K8S_CTX}" create configmap "${MDB_TLS_CA_CONFIGMAP}" -n "${MDB_NS}" \
56  --from-file=ca-pem="${TMP_CA_CERT}" --from-file=mms-ca.crt="${TMP_CA_CERT}" \
57  --from-file=ca.crt="${TMP_CA_CERT}" \
58  --dry-run=client -o yaml | kubectl --context "${K8S_CTX}" apply -f -
59
60echo "Cluster-wide CA issuer ${MDB_TLS_CA_ISSUER} is ready."
8

필수입니다. TLS 인증서를 발급합니다.

MongoDB 서버와 MongoDBSearch 서비스 모두에 대해 TLS 인증서를 발급합니다. MongoDB 서버 인증서에는 포드 및 서비스 통신에 필요한 모든 DNS 이름이 포함되어 있습니다. 두 인증서 모두 서버 및 클라이언트 인증 지원 .

1server_certificate="${MDB_RESOURCE_NAME}-server-tls"
2search_certificate="${MDB_RESOURCE_NAME}-search-tls"
3
4mongo_dns_names=()
5for ((member = 0; member < MDB_MEMBERS; member++)); do
6  mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}")
7  mongo_dns_names+=("${MDB_RESOURCE_NAME}-${member}.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local")
8done
9mongo_dns_names+=(
10  "${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
11  "*.${MDB_RESOURCE_NAME}-svc.${MDB_NS}.svc.cluster.local"
12)
13
14search_dns_names=(
15  "${MDB_RESOURCE_NAME}-search-svc.${MDB_NS}.svc.cluster.local"
16)
17
18render_dns_list() {
19  local dns_list=("$@")
20  for dns in "${dns_list[@]}"; do
21    printf "      - \"%s\"\n" "${dns}"
22  done
23}
24
25kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF_MANIFEST
26apiVersion: cert-manager.io/v1
27kind: Certificate
28metadata:
29  name: ${server_certificate}
30  namespace: ${MDB_NS}
31spec:
32  secretName: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
33  issuerRef:
34    name: ${MDB_TLS_CA_ISSUER}
35    kind: ClusterIssuer
36  duration: 240h0m0s
37  renewBefore: 120h0m0s
38  usages:
39    - digital signature
40    - key encipherment
41    - server auth
42    - client auth
43  dnsNames:
44$(render_dns_list "${mongo_dns_names[@]}")
45---
46apiVersion: cert-manager.io/v1
47kind: Certificate
48metadata:
49  name: ${search_certificate}
50  namespace: ${MDB_NS}
51spec:
52  secretName: ${MDB_SEARCH_TLS_SECRET_NAME}
53  issuerRef:
54    name: ${MDB_TLS_CA_ISSUER}
55    kind: ClusterIssuer
56  duration: 240h0m0s
57  renewBefore: 120h0m0s
58  usages:
59    - digital signature
60    - key encipherment
61    - server auth
62    - client auth
63  dnsNames:
64$(render_dns_list "${search_dns_names[@]}")
65EOF_MANIFEST
66
67kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${server_certificate}" --timeout=300s
68kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=condition=Ready certificate "${search_certificate}" --timeout=300s
69
70echo "MongoDB TLS certificates have been issued."
9

조건부. MongoDB Community 리소스 만들고 배포 .

이미 MongoDB Community Edition 배포한 경우 이 단계를 건너뛰세요. 그렇지 않으면 MongoDB Community Edition 배포 .

MongoDB Community Edition 배포 하려면 다음 단계를 완료하세요.

  1. mdb-rs(이)라는 MongoDBCommunity 사용자 지정 리소스 만듭니다.

    리소스 mongod 및 mongodb-agent 컨테이너에 대한 CPU 및 메모리 리소스를 정의하고 다음 세 사용자를 설정합니다.

    mdb-user

    데이터베이스 복원 하고 검색 쿼리를 실행 수 있는 사용자입니다. 이 사용자는 mdb-user-password 시크릿을 사용하여 이러한 작업을 수행합니다.

    search-sync-source

    MongoDB Search가 인덱스를 관리 하고 빌드 위해 MongoDB database 에 연결하는 데 사용하는 사용자입니다. 이 사용자는 Kubernetes 연산자 생성하는 searchCoordinator 역할 사용합니다. 이는 mdbc-rs-search-sync-source-password 시크릿을 사용하여 mongot 를 mongod에 연결합니다.

    admin-user

    데이터베이스 관리자 사용자입니다.

    Kubernetes Operator는 이 리소스 사용하여 3 멤버로 MongoDB 복제본 세트 구성합니다.

    시크릿을 생성하려면 다음 명령을 복사하여 붙여넣고 실행 .

    1kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
    2apiVersion: mongodbcommunity.mongodb.com/v1
    3kind: MongoDBCommunity
    4metadata:
    5  name: ${MDB_RESOURCE_NAME}
    6spec:
    7  version: ${MDB_VERSION}
    8  type: ReplicaSet
    9  members: ${MDB_MEMBERS}
    10  security:
    11    tls:
    12      enabled: true
    13      certificateKeySecretRef:
    14        name: ${MDB_TLS_SERVER_CERT_SECRET_NAME}
    15      caConfigMapRef:
    16        name: ${MDB_TLS_CA_CONFIGMAP}
    17    authentication:
    18      ignoreUnknownUsers: true
    19      modes:
    20        - SCRAM
    21  agent:
    22    logLevel: DEBUG
    23  statefulSet:
    24    spec:
    25      template:
    26        spec:
    27          containers:
    28            - name: mongod
    29              resources:
    30                limits:
    31                  cpu: "2"
    32                  memory: 2Gi
    33                requests:
    34                  cpu: "1"
    35                  memory: 1Gi
    36            - name: mongodb-agent
    37              resources:
    38                limits:
    39                  cpu: "1"
    40                  memory: 2Gi
    41                requests:
    42                  cpu: "0.5"
    43                  memory: 1Gi
    44  users:
    45    # admin user with root role
    46    - name: mdb-admin
    47      db: admin
    48      # a reference to the secret containing user password
    49      passwordSecretRef:
    50        name: mdb-admin-user-password
    51      scramCredentialsSecretName: mdb-admin-user
    52      roles:
    53        - name: root
    54          db: admin
    55    # user performing search queries
    56    - name: mdb-user
    57      db: admin
    58      # a reference to the secret containing user password
    59      passwordSecretRef:
    60        name: mdb-user-password
    61      scramCredentialsSecretName: mdb-user-scram
    62      roles:
    63        - name: restore
    64          db: sample_mflix
    65        - name: readWrite
    66          db: sample_mflix
    67    # user used by MongoDB Search to connect to MongoDB database to
    68    # synchronize data from.
    69    # For MongoDB <8.2, the operator will be creating the
    70    # searchCoordinator custom role automatically.
    71    # From MongoDB 8.2, searchCoordinator role will be a
    72    # built-in role.
    73    - name: search-sync-source
    74      db: admin
    75      # a reference to the secret that will be used to generate the user's password
    76      passwordSecretRef:
    77        name: ${MDB_RESOURCE_NAME}-search-sync-source-password
    78      scramCredentialsSecretName: ${MDB_RESOURCE_NAME}-search-sync-source
    79      roles:
    80        - name: searchCoordinator
    81          db: admin
    82EOF

  2. MongoDBCommunity 리소스 배포서버 완료될 때까지 기다립니다.

    MongoDBCommunity 사용자 지정 리소스 적용 Kubernetes 연산자 MongoDB 노드(포드) 배포를 시작합니다. 이 단계에서는 mdbc-rs 리소스의 상태 단계가 Running가 되어 MongoDB Community 복제본 세트 작동 가능함을 나타낼 때까지 실행을 일시 중지합니다.

    1echo "Waiting for MongoDBCommunity resource to reach Running phase..."
    2kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
    3  --for=jsonpath='{.status.phase}'=Running mdbc/mdbc-rs --timeout=400s
    4echo; echo "MongoDBCommunity resource"
    5kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs
    6echo; echo "Pods running in cluster ${K8S_CTX}"
    7kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
    1Waiting for MongoDBCommunity resource to reach Running phase...
    2mongodbcommunity.mongodbcommunity.mongodb.com/mdbc-rs condition met
    3
    4MongoDBCommunity resource
    5NAME      PHASE     VERSION
    6mdbc-rs   Running   8.2
    7
    8Pods running in cluster minikube
    9NAME                                           READY   STATUS    RESTARTS   AGE
    10mdbc-rs-0                                      2/2     Running   0          2m30s
    11mdbc-rs-1                                      2/2     Running   0          82s
    12mdbc-rs-2                                      2/2     Running   0          38s
    13mongodb-kubernetes-operator-5776c8b4df-cppnf   1/1     Running   0          7m37s
10

필수입니다. MongoDB Search 및 Vector Search를 위한 리소스 생성하고 배포 .

로드 밸런싱 없이 검색 노드 의 인스턴스 하나를 배포 할 수 있습니다. 배포 하려면 다음 단계를 완료하세요.

  1. mdbc-rs이라는 이름의 MongoDBSearch 사용자 지정 리소스 만듭니다.

    이 리소스 검색 노드에 대한 CPU 및 메모리 리소스 요구 사항을 지정합니다. 이 사용자 지정 리소스의 설정에 대해 자세히 학습하려면 MongoDB 검색 및 벡터 검색 설정을 참조하세요.

    1kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
    2apiVersion: mongodb.com/v1
    3kind: MongoDBSearch
    4metadata:
    5  name: ${MDB_RESOURCE_NAME}
    6spec:
    7  security:
    8    tls:
    9      certificateKeySecretRef:
    10        name: ${MDB_SEARCH_TLS_SECRET_NAME}
    11  resourceRequirements:
    12    limits:
    13      cpu: "3"
    14      memory: 5Gi
    15    requests:
    16      cpu: "2"
    17      memory: 3Gi
    18EOF

  2. MongoDBSearch 리소스 배포서버 완료될 때까지 기다립니다.

    MongoDBSearch 사용자 지정 리소스 적용 하면 Kubernetes 연산자 검색 노드(pod) 배포를 시작합니다. 이 단계에서는 mdbc-rs MongoDBSearch 리소스의 상태 단계가 Running가 되어 MongoDB Search가 작동 가능함을 나타낼 때까지 실행을 일시 중지합니다.

    1echo "Waiting for MongoDBSearch resource to reach Running phase..."
    2kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
    3  --for=jsonpath='{.status.phase}'=Running mdbs/"${MDB_RESOURCE_NAME}" --timeout=300s
11

선택 사항. MongoDB Community 리소스 상태를 확인합니다.

MongoDBSearch를 사용한 MongoDBCommunity 리소스 배포서버 성공적인 했는지 확인합니다.

1echo "Waiting for MongoDBCommunity resource to reach Running phase..."
2kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
3  --for=jsonpath='{.status.phase}'=Running mdbc/mdbc-rs --timeout=400s
4echo; echo "MongoDBCommunity resource"
5kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs
6echo; echo "Pods running in cluster ${K8S_CTX}"
7kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
12

선택 사항. 네임스페이스 에서 실행 모든 파드를 확인합니다.

네임스페이스 파드에서 MongoDB 복제본 세트 멤버, Kubernetes Operator용 MongoDB 컨트롤러 및 검색 노드에 대해 실행 모든 파드를 확인합니다.

1echo; echo "MongoDBCommunity resource"
2kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbc/mdbc-rs
3echo; echo "MongoDBSearch resource"
4kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbs/mdbc-rs
5echo; echo "Pods running in cluster ${K8S_CTX}"
6kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
1MongoDBCommunity resource
2NAME      PHASE     VERSION
3mdbc-rs   Running   8.2.0
4
5MongoDBSearch resource
6NAME      PHASE     VERSION   AGE
7mdbc-rs   Running   0.55.0    5m11s
8
9Pods running in cluster kind-kind
10NAME                                           READY   STATUS    RESTARTS       AGE
11mdbc-rs-0                                      2/2     Running   1 (25s ago)    7m42s
12mdbc-rs-1                                      2/2     Running   1 (3m ago)     6m32s
13mdbc-rs-2                                      2/2     Running   1 (103s ago)   5m45s
14mdbc-rs-search-0                               1/1     Running   0              5m11s
15mongodb-kubernetes-operator-7bd6cdd889-v8l9n   1/1     Running   0              8m6s

다음 단계

이제 MongoDB Community Edition 과 함께 사용할 MongoDB Search 및 Vector Search를 성공적으로 배포했으므로, MongoDB cluster 에 데이터를 추가하고, MongoDB Search 및 Vector Search 인덱스를 생성하고, 데이터에 대해 쿼리를 실행 . 자세히 학습하려면 MongoDB 검색 및 벡터 검색 사용을 참조하세요.

이 페이지의 내용