The kubectl mongodb plugin always adds the mongodb.com/migration-dry-run: true annotation to the resource it generates for migrating a deployment into Kubernetes. While that annotation is present, Kubernetes Operator makes no automation config changes. It only validates connectivity and credentials, so you can fix problems and re-run as many times as you need before Kubernetes Operator takes ownership of the deployment.
이 작업에 대하여
Kubernetes Operator creates one Job per
MongoDBresource, named<resourceName>-connectivity-check. The Job dials every external member and authenticates against it. It deletes itself usingttlSecondsAfterFinished, and the next reconcile re-creates it, so re-validation after a fix is automatic. You do not need to trigger it manually.The dry run checks Kubernetes-to-virtual-machine reachability (DNS, TLS, firewalls, and member addresses) and credentials, including the
__systemrole on thelocaldatabase, and the CA when TLS is enabled.The dry run does not check virtual-machine-to-Kubernetes inbound connectivity. Verify that direction yourself, either through the Ops Manager UI monitoring status for the deployment or by running
rs.status()from a virtual machine member and confirming it can reach the Kubernetes Pods.플러그인 및 Kubernetes Operator 버전 확인은 테스트 실행 주석의 존재 여부에 관계없이 실행됩니다.
시작하기 전에
A generated
MongoDBcustom resource with themongodb.com/migration-dry-run: trueannotation still present. To learn how to generate this resource, see Migrate a Replica Set to Kubernetes.If the deployment uses TLS, the member certificates and CA material described in Configure TLS for a Migration to Kubernetes.
The Kubernetes Operator
ServiceAccounthasbatch/jobspermissions (create,get,list,watch, anddelete). Without this grant, Kubernetes Operator cannot create the connectivity validator Job at all.
절차
리소스 적용하고 실행 를 실행 합니다.
Apply the MongoDB custom resource with the dry-run annotation still set. Kubernetes Operator creates the <resourceName>-connectivity-check Job and reports progress through status.phase and the NetworkConnectivityVerified condition.
While the Job runs, status.phase reads ConnectivityCheckRunning.
결과를 읽습니다.
Read status.conditions[type=NetworkConnectivityVerified]:
유효성 검사기 작업 종료 코드 | 조건 상태 | 이유 | 의미 |
|---|---|---|---|
작업이 아직 실행 . |
|
| The |
|
|
| 모든 외부 멤버에 연결할 수 있고 인증됩니다. |
|
|
| Credentials, the authentication mechanism, or a missing |
|
|
| DNS, TLS, 시간 초과 또는 연결할 수 없는 멤버. Job Pod 로그를 확인합니다. |
|
|
| 분류되지 않은 오류입니다. Job Pod 로그를 확인합니다. |
Failures that occur before the Job starts use the reasons OperatorImageUnknown, BuildStatefulSetOptions, AgentCertSecretFailed, and AgentCertSubject.
Kubernetes Operator removes the NetworkConnectivityVerified condition from status.conditions entirely once no external members remain.
필요한 경우 문제를 수정하고 다시 실행합니다.
Fix connectivity or credential problems in Kubernetes or in the Ops Manager UI, as needed. You do not need to delete or re-apply anything: the next reconcile re-creates the validator Job automatically.
If the dry run appears stuck, delete the <resourceName>-connectivity-check Job. The next reconcile re-creates it.
A missing batch/jobs RBAC grant on the Kubernetes Operator ServiceAccount prevents the Job from being created in the first place, so no condition or Job appears at all in that case. Failures that occur before the Job starts surface as reasons OperatorImageUnknown, BuildStatefulSetOptions, AgentCertSecretFailed, or AgentCertSubject instead of the exit-code reasons in the table above.
계속하려면 테스트 실행 주석을 제거하세요.
When the NetworkConnectivityVerified condition is True with reason NetworkValidationPassed, remove the annotation:
kubectl annotate mdb <resourceName> \ mongodb.com/migration-dry-run-
중요
Removing the dry-run annotation is the point at which Kubernetes Operator takes ownership of the Ops Manager or Cloud Manager project. Treat this as the point of no return for the connectivity and credential state you just validated.