Conjuntos de réplicas de vários clusters

As implementações do MongoDB de cluster multi-Kubernetes permitem adicionar instâncias do MongoDB em clusters globais que abrangem várias regiões geográficas para maior disponibilidade e distribuição global de dados.

Pré-requisitos

Antes de iniciar o procedimento a seguir, execute as seguintes ações:

Instale o kubectl.
Instalar Mongosh
Conclua o procedimento GKE Clusters ou equivalente.
Conclua o procedimento Certificados TLS ou equivalente.
Conclua o procedimento Istion Service Mesh ou equivalente.
Conclua o procedimento Implementar o operador MongoDB.
Conclua o procedimento de procedimento do Multi-Cluster Ops Manager. Você pode pular esta etapa se usar o Cloud Manager em vez do Ops Manager.
Configure as variáveis de ambiente necessárias da seguinte maneira:

# This script builds on top of the environment configured in the setup guides.
# It depends (uses) the following env variables defined there to work correctly.
# If you don't use the setup guide to bootstrap the environment, then define them here.
#  ${K8S_CLUSTER_0_CONTEXT_NAME}
#  ${K8S_CLUSTER_1_CONTEXT_NAME}
#  ${K8S_CLUSTER_2_CONTEXT_NAME}
#  ${MDB_NAMESPACE}
export RS_RESOURCE_NAME=mdb
export MONGODB_VERSION="8.0.5-ent"

código fonte

Você pode encontrar todo o código-fonte incluído no repositório do MongoDB Kubernetes Operator.

Procedimento

Crie um certificado CA.

Execute o seguinte script para criar o Certificado CA necessário com seu emissor de certificado.

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2 apiVersion: cert-manager.io/v1
3 kind: Certificate
4 metadata:
5   name: mdb-cert
6 spec:
7   dnsNames:
8   - "*.${MDB_NAMESPACE}.svc.cluster.local"
9   duration: 240h0m0s
10   issuerRef:
11     name: my-ca-issuer
12     kind: ClusterIssuer
13   renewBefore: 120h0m0s
14   secretName: cert-prefix-mdb-cert
15   usages:
16   - server auth
17   - client auth
18 EOF

Implemente o `MongoDBMultiCluster` recurso.

Defina spec.credentials, spec.opsManager.configMapRef.name, que você definiu no procedimento do Multi-Cluster Ops Manager; defina suas configurações de segurança e implante o recurso MongoDBMultiCluster. Na amostra de código a seguir, duplicateServiceObjects está definido como false para habilitar o proxy de DNS no Istipo.

Observação

Para habilitar a resolução de DNS entre clusters pela malha de serviço do Istío, este tutorial cria objetos de serviço com um único endereço ClusterIP por cada Pod do Kubernetes.

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2 apiVersion: mongodb.com/v1
3 kind: MongoDBMultiCluster
4 metadata:
5   name: ${RS_RESOURCE_NAME}
6 spec:
7   type: ReplicaSet
8   version: ${MONGODB_VERSION}
9   opsManager:
10     configMapRef:
11       name: mdb-org-project-config
12   credentials: mdb-org-owner-credentials
13   duplicateServiceObjects: false
14   persistent: true
15   backup:
16     mode: enabled
17   externalAccess: {}
18   security:
19     certsSecretPrefix: cert-prefix
20     tls:
21       ca: ca-issuer
22     authentication:
23       enabled: true
24       modes: ["SCRAM"]
25   clusterSpecList:
26     - clusterName: ${K8S_CLUSTER_0_CONTEXT_NAME}
27       members: 2
28     - clusterName: ${K8S_CLUSTER_1_CONTEXT_NAME}
29       members: 1
30     - clusterName: ${K8S_CLUSTER_2_CONTEXT_NAME}
31       members: 2
32 EOF

Verifique se o recurso `MongoDBMultiCluster` está em execução.

Execute o seguinte comando para confirmar que o recurso MongoDBMultiCluster está em execução.

1 echo; echo "Waiting for MongoDB to reach Running phase..."
2 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" wait --for=jsonpath='{.status.phase}'=Running "mdbmc/${RS_RESOURCE_NAME}" --timeout=900s
3 echo; echo "Pods running in cluster ${K8S_CLUSTER_0_CONTEXT_NAME}"
4 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
5 echo; echo "Pods running in cluster ${K8S_CLUSTER_1_CONTEXT_NAME}"
6 kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
7 echo; echo "Pods running in cluster ${K8S_CLUSTER_2_CONTEXT_NAME}"
8 kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods

Crie um usuário e senha do MongoDB .

Execute o comando a seguir para criar um usuário e senha do MongoDB . Use senhas fortes para seus sistemas.

1 kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2 apiVersion: v1
3 kind: Secret
4 metadata:
5   name: rs-user-password
6 type: Opaque
7 stringData:
8   password: password
9 ---
10 apiVersion: mongodb.com/v1
11 kind: MongoDBUser
12 metadata:
13   name: rs-user
14 spec:
15   passwordSecretKeyRef:
16     name: rs-user-password
17     key: password
18   username: "rs-user"
19   db: "admin"
20   mongodbResourceRef:
21     name: ${RS_RESOURCE_NAME}
22   roles:
23   - db: "admin"
24     name: "root"
25 EOF
26 
27 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=jsonpath='{.status.phase}'=Updated -n "${MDB_NAMESPACE}" mdbu/rs-user --timeout=300s

Verifique a conectividade.

Execute o seguinte comando mongosh para garantir que você possa acessar sua instância MongoDB em execução.

1 external_ip="$(kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" svc "${RS_RESOURCE_NAME}-0-0-svc-external" -o=jsonpath="{.status.loadBalancer.ingress[0].ip}")"
2 
3 mkdir -p certs
4 kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" cm/ca-issuer -o=jsonpath='{.data.ca-pem}' > certs/ca.crt
5 
6 mongosh --host "${external_ip}" --username rs-user --password password --tls --tlsCAFile certs/ca.crt --tlsAllowInvalidHostnames --eval "db.runCommand({connectionStatus : 1})"

{
  authInfo: {
    authenticatedUsers: [ { user: 'rs-user', db: 'admin' } ],
    authenticatedUserRoles: [ { role: 'root', db: 'admin' } ]
  },
  ok: 1,
  '$clusterTime': {
    clusterTime: Timestamp({ t: 1747925179, i: 1 }),
    signature: {
      hash: Binary.createFromBase64('T1ZP+QUFgBXayfOsRI6XFdEmjKI=', 0),
      keyId: Long('7507281432415305733')
    }
  },
  operationTime: Timestamp({ t: 1747925179, i: 1 })
}

Voltar

Ops Manager de vários clusters

Cluster fragmentado de vários clusters

1	kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2	apiVersion: cert-manager.io/v1
3	kind: Certificate
4	metadata:
5	name: mdb-cert
6	spec:
7	dnsNames:
8	- "*.${MDB_NAMESPACE}.svc.cluster.local"
9	duration: 240h0m0s
10	issuerRef:
11	name: my-ca-issuer
12	kind: ClusterIssuer
13	renewBefore: 120h0m0s
14	secretName: cert-prefix-mdb-cert
15	usages:
16	- server auth
17	- client auth
18	EOF

1	kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2	apiVersion: mongodb.com/v1
3	kind: MongoDBMultiCluster
4	metadata:
5	name: ${RS_RESOURCE_NAME}
6	spec:
7	type: ReplicaSet
8	version: ${MONGODB_VERSION}
9	opsManager:
10	configMapRef:
11	name: mdb-org-project-config
12	credentials: mdb-org-owner-credentials
13	duplicateServiceObjects: false
14	persistent: true
15	backup:
16	mode: enabled
17	externalAccess: {}
18	security:
19	certsSecretPrefix: cert-prefix
20	tls:
21	ca: ca-issuer
22	authentication:
23	enabled: true
24	modes: ["SCRAM"]
25	clusterSpecList:
26	- clusterName: ${K8S_CLUSTER_0_CONTEXT_NAME}
27	members: 2
28	- clusterName: ${K8S_CLUSTER_1_CONTEXT_NAME}
29	members: 1
30	- clusterName: ${K8S_CLUSTER_2_CONTEXT_NAME}
31	members: 2
32	EOF

1	echo; echo "Waiting for MongoDB to reach Running phase..."
2	kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" wait --for=jsonpath='{.status.phase}'=Running "mdbmc/${RS_RESOURCE_NAME}" --timeout=900s
3	echo; echo "Pods running in cluster ${K8S_CLUSTER_0_CONTEXT_NAME}"
4	kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
5	echo; echo "Pods running in cluster ${K8S_CLUSTER_1_CONTEXT_NAME}"
6	kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
7	echo; echo "Pods running in cluster ${K8S_CLUSTER_2_CONTEXT_NAME}"
8	kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods

1	kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
2	apiVersion: v1
3	kind: Secret
4	metadata:
5	name: rs-user-password
6	type: Opaque
7	stringData:
8	password: password
9	---
10	apiVersion: mongodb.com/v1
11	kind: MongoDBUser
12	metadata:
13	name: rs-user
14	spec:
15	passwordSecretKeyRef:
16	name: rs-user-password
17	key: password
18	username: "rs-user"
19	db: "admin"
20	mongodbResourceRef:
21	name: ${RS_RESOURCE_NAME}
22	roles:
23	- db: "admin"
24	name: "root"
25	EOF
26
27	kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=jsonpath='{.status.phase}'=Updated -n "${MDB_NAMESPACE}" mdbu/rs-user --timeout=300s

1	external_ip="$(kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" svc "${RS_RESOURCE_NAME}-0-0-svc-external" -o=jsonpath="{.status.loadBalancer.ingress[0].ip}")"
2
3	mkdir -p certs
4	kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" cm/ca-issuer -o=jsonpath='{.data.ca-pem}' > certs/ca.crt
5
6	mongosh --host "${external_ip}" --username rs-user --password password --tls --tlsCAFile certs/ca.crt --tlsAllowInvalidHostnames --eval "db.runCommand({connectionStatus : 1})"