本节将指导您为MongoDB的每个组件创建 TLS 证书，以及在每个Kubernetes集群中创建Kubernetes密钥，以便将 TLS 证书安全地挂载到相应的Kubernetes Pod 中。
下面概述的进程利用证书经理创建 TLS 证书。但请注意，这是一份固执己见的指南， MongoDB不支持 CertManager。此外，CertManager 只是向Kubernetes集群添加 TLS 证书的众多方法之一。此外，自签名证书可能不适合生产部署，具体取决于组织的安全要求。如果您需要公开信任的证书，请相应地配置您的发行者或直接提供 TLS 证书。要学习；了解更多信息，请参阅设置证书管理器集成。
先决条件
开始之前，请执行以下任务：
安装
kubectl。按照 GKE 集群指南 中的说明设置
K8S_CLUSTER_*_CONTEXT_NAME环境变量。
源代码
您可以在MongoDB Kubernetes Operator存储库中找到所有包含的源代码。
步骤
2
使用 Helm 安装 cert-manager。
helm upgrade --install \ cert-manager jetstack/cert-manager \ --kube-context "${K8S_CLUSTER_0_CONTEXT_NAME}" \ --namespace cert-manager \ --create-namespace \ --set crds.enabled=trueRelease "cert-manager" does not exist. Installing it now.NAME: cert-managerLAST DEPLOYED: Tue Oct 20 08:52:33 2026NAMESPACE: cert-managerSTATUS: deployedREVISION: 1TEST SUITE: NoneNOTES:cert-manager v1.21.2 has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssueror Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
More information on the different types of issuers and how to configure themcan be found in our documentation:
https://cert-manager.io/docs/configuration/
For information on how to configure cert-manager to automatically provisionCertificates for Ingress resources, take a look at the `ingress-shim`documentation:
https://cert-manager.io/docs/usage/ingress/
For information on how to configure cert-manager to automatically provisionCertificates for Gateway API resources, take a look at the `gateway resource`documentation:
https://cert-manager.io/docs/usage/gateway/3
创建证书颁发者。
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata: name: selfsigned-cluster-issuerspec: selfSigned: {}EOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer selfsigned-cluster-issuer
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: my-selfsigned-ca namespace: cert-managerspec: isCA: true commonName: my-selfsigned-ca secretName: root-secret privateKey: algorithm: ECDSA size: 256 issuerRef: name: selfsigned-cluster-issuer kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready -n cert-manager certificate my-selfsigned-ca
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata: name: my-ca-issuerspec: ca: secretName: root-secretEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer my-ca-issuer4
验证发行者的创建。
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: test-selfsigned-cert namespace: cert-managerspec: dnsNames: - example.com secretName: test-selfsigned-cert-tls issuerRef: name: my-ca-issuer kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait -n cert-manager --for=condition=Ready certificate test-selfsigned-cert
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete -n cert-manager certificate test-selfsigned-certcertificate.cert-manager.io/test-selfsigned-cert createdcertificate.cert-manager.io/test-selfsigned-cert condition metcertificate.cert-manager.io "test-selfsigned-cert" deleted from cert-manager namespace5
创建 CA configMap。
如果您的 MongoDB Ops Manager TLS 证书由自定义 CA 签名，则该 CA 证书还必须包含其他证书，允许代理从互联网下载 MongoDB 二进制文件。要创建 TLS 证书，请创建 ConfigMap 以保存 CA 证书：
mkdir -p certs
openssl s_client -showcerts -verify 2 \-connect downloads.mongodb.com:443 -servername downloads.mongodb.com < /dev/null \| awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="certs/cert"a".crt"; print >out}'
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" get secret root-secret -n cert-manager -o jsonpath="{.data['ca\.crt']}" | base64 --decode > certs/ca.crtcat certs/ca.crt certs/cert2.crt certs/cert3.crt >> certs/mms-ca.crt
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${MDB_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crtkubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${OM_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crt