支持使用Kubernetes 操作符部署MongoDB Search 和MongoDB Vector Search 是作为 Preview功能提供的。在预览期间，功能和相应的文档可能随时更改。要学习；了解详情，请参阅 预览功能。
您可以使用Kubernetes Operator 在Kubernetes集群上部署MongoDB Search 和 Vector Search，与外部MongoDB Enterprise Edition v8.2.0 或更高版本的服务器一起运行。此过程演示如何在Kubernetes集群中部署和配置mongot 进程，以使用新的或现有的外部副本集部署。本教程演示如何配置启用 TLS 的安全部署。您必须提供 TLS 证书：
MongoDBSearch 服务的服务器证书和密钥。
外部MongoDB 数据库的公共 CA 证书。
先决条件
要部署MongoDB Search 和 Vector Search，您必须具备以下条件：
一个运行的Kubernetes集群，且本地可用
kubeconfig。Kubernetes命令行工具
kubectl，配置为与集群通信。Helm（ Kubernetes的包管理器），用于安装Kubernetes Operator。
Bash v5.1 或更高版本，用于运行本教程中的命令。
运行8.2 或更高版本的MongoDB Enterprise Edition副本集，用于存储数据。
要学习；了解有关部署MongoDB Enterprise 的更多信息，请参阅 部署和配置MongoDB数据库资源。
运行的MongoDB Cloud Manager或MongoDB Ops Manager ，用于管理MongoDB任务。
外部数据库 TLS
您的外部MongoDB Enterprise部署必须配置为使用并要求 TLS 连接。
外部数据库 CA文件
您必须拥有用于签署外部MongoDB部署服务器证书的公共证书颁发机构 (CA) 证书文件（示例
external-ca.crt）。您在本地需要此文件。Search Service 证书文件
您必须拥有
search-service.crtsearch-service.keyMongoDBSearch 服务的有效 TLS服务器证书和私钥（示例 、 ）。此证书必须对用于访问权限服务的主机名有效（示例，mdbs-search.example.com）。
开始之前
在使用Kubernetes Operator 安装MongoDB Search 和 Vector Search 之前，您必须执行以下操作：
为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager参数
为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager用户
为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager参数
登录到Cloud Manager或MongoDB Ops Manager用户界面并执行以下步骤，为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager 。
1
2
修改Cloud Manager或MongoDB Ops Manager部署配置。
单击 Modify 按钮打开部署配置编辑器。
在 Process Configuration（添加特性和功能）部分下，单击 Advanced Configuration Options（权限）。
单击 Add Option 按钮，然后从下拉列表中选择 setParameter Startup Option。
添加名称和值后，单击 Add，在字段中逐个添加以下参数：
Parameter值mongotHost您的搜索主机名和端口。示例：
search-node1.example.com:27017。searchIndexManagementHostAndPort您的搜索主机名和端口。示例：
search-node1.example.com:27017。skipAuthenticationToSearchIndexManagementServerfalsesearchTLSMode您配置的 TLS模式。示例，如果
mongot进程配置为接受 TLS 连接，则为preferTLS。useGrpcForSearchtrue
为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager用户
您必须创建具有searchCoordinator 角色的用户。在MongoDB8.2 及更高版本中，searchCoordinator 是一个内置角色。您必须创建一个用户并为该用户分配角色。
要创建用户并为其内置searchCoordinator角色，请使用Cloud Manager或MongoDB Ops Manager用户界面或mongosh完成以下步骤：
在 mongosh 中，运行以下命令：
设置您的环境
准备环境，以便在终端中运行本教程中的示例代码。
1
必填。设置环境变量。
要设立环境变量以供本过程的后续步骤使用，请复制以下内容，设立环境变量的值，然后在终端中运行命令：
1 export K8S_CTX="<your kubernetes context here>" 2 3 export MDB_NS="mongodb" 4 5 export MDB_VERSION="8.2.0" 6 7 export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME" 8 export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME" 9 export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME" 10 11 export MDB_TLS_CA_SECRET_NAME="ca" 12 export MDB_SEARCH_TLS_SECRET_NAME="mdbs-search-tls" 13 14 export MDB_SEARCH_SERVICE_NAME="mdbs-search" 15 export MDB_SEARCH_HOSTNAME="mdbs-search.example.com" 16 17 # External MongoDB replica set members - REPLACE THESE VALUES with your actual external MongoDB hosts 18 # In production, replace with your actual external MongoDB replica set members 19 export MDB_EXTERNAL_HOST_0="mdbc-rs-0.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017" 20 export MDB_EXTERNAL_HOST_1="mdbc-rs-1.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017" 21 export MDB_EXTERNAL_HOST_2="mdbc-rs-2.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017" 22 23 # REPLACE with your actual external MongoDB replica set name 24 export MDB_EXTERNAL_REPLICA_SET_NAME="mdbc-rs" 25 26 export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes" 27 export OPERATOR_ADDITIONAL_HELM_VALUES="" 28 29 export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_EXTERNAL_HOST_0}/?replicaSet=${MDB_EXTERNAL_REPLICA_SET_NAME}&tls=true&tlsCAFile=/tls/ca.crt"
请注意，这些环境变量仅在当前终端会话中可用，并且需要在任何新的终端会话中重新设立。
2
有条件。添加MongoDB Helm存储库。
Helm 可自动部署和管理Kubernetes上的MongoDB实例。如果您已经添加了包含用于安装Kubernetes Operator 操作符 的Helm图表的Helm存储库，请跳过此步骤。否则，请添加Helm存储库。
要添加、复制、粘贴并运行以下命令：
1 helm repo add mongodb https://mongodb.github.io/helm-charts 2 helm repo update mongodb 3 helm search repo mongodb/mongodb-kubernetes
1 "mongodb" has been added to your repositories 2 Hang tight while we grab the latest from your chart repositories... 3 ...Successfully got an update from the "mongodb" chart repository 4 Update Complete. ⎈Happy Helming!⎈ 5 NAME CHART VERSION APP VERSION DESCRIPTION 6 mongodb/mongodb-kubernetes 1.6.1 MongoDB Controllers for Kubernetes translate th...
3
有条件。为Kubernetes Operator 安装MongoDB控制器。
Kubernetes Operator 监视MongoDB 、MongoDBOpsManager 和 MongoDBSearch 自定义资源，并管理MongoDB部署的生命周期。如果您已经安装了MongoDB Controllers for Kubernetes Operator，请跳过此步骤。否则，请从您在上一步中添加的 Helm存储库安装MongoDB Controllers for Kubernetes Operator。
要在 mongodb命名空间中安装MongoDB Controllers for Kubernetes Operator，请复制、粘贴并运行以下命令：
1 helm upgrade --install --debug --kube-context "${K8S_CTX}" \ 2 --create-namespace \ 3 --namespace="${MDB_NS}" \ 4 mongodb-kubernetes \ 5 {OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \ 6 "${OPERATOR_HELM_CHART}"
1 Release "mongodb-kubernetes" does not exist. Installing it now. 2 NAME: mongodb-kubernetes 3 LAST DEPLOYED: Wed Dec 17 11:23:39 2025 4 NAMESPACE: mongodb 5 STATUS: deployed 6 REVISION: 1 7 TEST SUITE: None 8 USER-SUPPLIED VALUES: 9 {} 10 11 COMPUTED VALUES: 12 agent: 13 name: mongodb-agent 14 version: 108.0.12.8846-1 15 community: 16 agent: 17 name: mongodb-agent 18 version: 108.0.2.8729-1 19 mongodb: 20 imageType: ubi8 21 name: mongodb-community-server 22 repo: quay.io/mongodb 23 registry: 24 agent: quay.io/mongodb 25 resource: 26 members: 3 27 name: mongodb-replica-set 28 tls: 29 caCertificateSecretRef: tls-ca-key-pair 30 certManager: 31 certDuration: 8760h 32 renewCertBefore: 720h 33 certificateKeySecretRef: tls-certificate 34 enabled: false 35 sampleX509User: false 36 useCertManager: true 37 useX509: false 38 version: 4.4.0 39 database: 40 name: mongodb-kubernetes-database 41 version: 1.6.1 42 initAppDb: 43 name: mongodb-kubernetes-init-appdb 44 version: 1.6.1 45 initDatabase: 46 name: mongodb-kubernetes-init-database 47 version: 1.6.1 48 initOpsManager: 49 name: mongodb-kubernetes-init-ops-manager 50 version: 1.6.1 51 managedSecurityContext: false 52 mongodb: 53 appdbAssumeOldFormat: false 54 name: mongodb-enterprise-server 55 repo: quay.io/mongodb 56 multiCluster: 57 clusterClientTimeout: 10 58 clusters: [] 59 kubeConfigSecretName: mongodb-enterprise-operator-multi-cluster-kubeconfig 60 performFailOver: true 61 operator: 62 additionalArguments: [] 63 affinity: {} 64 baseName: mongodb-kubernetes 65 createOperatorServiceAccount: true 66 createResourcesServiceAccountsAndRoles: true 67 deployment_name: mongodb-kubernetes-operator 68 enableClusterMongoDBRoles: true 69 enablePVCResize: true 70 env: prod 71 maxConcurrentReconciles: 1 72 mdbDefaultArchitecture: non-static 73 name: mongodb-kubernetes-operator 74 nodeSelector: {} 75 operator_image_name: mongodb-kubernetes 76 podSecurityContext: 77 runAsNonRoot: true 78 runAsUser: 2000 79 replicas: 1 80 resources: 81 limits: 82 cpu: 1100m 83 memory: 1Gi 84 requests: 85 cpu: 500m 86 memory: 200Mi 87 securityContext: {} 88 telemetry: 89 collection: 90 clusters: {} 91 deployments: {} 92 frequency: 1h 93 operators: {} 94 send: 95 frequency: 168h 96 tolerations: [] 97 vaultSecretBackend: 98 enabled: false 99 tlsSecretRef: "" 100 version: 1.6.1 101 watchedResources: 102 - mongodb 103 - opsmanagers 104 - mongodbusers 105 - mongodbcommunity 106 - mongodbsearch 107 webhook: 108 installClusterRole: true 109 registerConfiguration: true 110 opsManager: 111 name: mongodb-enterprise-ops-manager-ubi 112 readinessProbe: 113 name: mongodb-kubernetes-readinessprobe 114 version: 1.0.23 115 registry: 116 agent: quay.io/mongodb 117 database: quay.io/mongodb 118 imagePullSecrets: null 119 initAppDb: quay.io/mongodb 120 initDatabase: quay.io/mongodb 121 initOpsManager: quay.io/mongodb 122 operator: quay.io/mongodb 123 opsManager: quay.io/mongodb 124 pullPolicy: Always 125 readinessProbe: quay.io/mongodb 126 versionUpgradeHook: quay.io/mongodb 127 search: 128 name: mongodb-search 129 repo: quay.io/mongodb 130 version: 0.55.0 131 versionUpgradeHook: 132 name: mongodb-kubernetes-operator-version-upgrade-post-start-hook 133 version: 1.0.10 134 135 HOOKS: 136 MANIFEST: 137 --- 138 Source: mongodb-kubernetes/templates/database-roles.yaml 139 apiVersion: v1 140 kind: ServiceAccount 141 metadata: 142 name: mongodb-kubernetes-appdb 143 namespace: mongodb 144 --- 145 Source: mongodb-kubernetes/templates/database-roles.yaml 146 apiVersion: v1 147 kind: ServiceAccount 148 metadata: 149 name: mongodb-kubernetes-database-pods 150 namespace: mongodb 151 --- 152 Source: mongodb-kubernetes/templates/database-roles.yaml 153 apiVersion: v1 154 kind: ServiceAccount 155 metadata: 156 name: mongodb-kubernetes-ops-manager 157 namespace: mongodb 158 --- 159 Source: mongodb-kubernetes/templates/operator-sa.yaml 160 apiVersion: v1 161 kind: ServiceAccount 162 metadata: 163 name: mongodb-kubernetes-operator 164 namespace: mongodb 165 --- 166 Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml 167 kind: ClusterRole 168 apiVersion: rbac.authorization.k8s.io/v1 169 metadata: 170 name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role 171 rules: 172 - apiGroups: 173 - mongodb.com 174 verbs: 175 - '*' 176 resources: 177 - clustermongodbroles 178 --- 179 Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml 180 Additional ClusterRole for clusterVersionDetection 181 kind: ClusterRole 182 apiVersion: rbac.authorization.k8s.io/v1 183 metadata: 184 name: mongodb-kubernetes-operator-cluster-telemetry 185 rules: 186 Non-resource URL permissions 187 - nonResourceURLs: 188 - "/version" 189 verbs: 190 - get 191 Cluster-scoped resource permissions 192 - apiGroups: 193 - '' 194 resources: 195 - namespaces 196 resourceNames: 197 - kube-system 198 verbs: 199 - get 200 - apiGroups: 201 - '' 202 resources: 203 - nodes 204 verbs: 205 - list 206 --- 207 Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml 208 kind: ClusterRole 209 apiVersion: rbac.authorization.k8s.io/v1 210 metadata: 211 name: mongodb-kubernetes-operator-mongodb-webhook-cr 212 rules: 213 - apiGroups: 214 - "admissionregistration.k8s.io" 215 resources: 216 - validatingwebhookconfigurations 217 verbs: 218 - get 219 - create 220 - update 221 - delete 222 - apiGroups: 223 - "" 224 resources: 225 - services 226 verbs: 227 - get 228 - list 229 - watch 230 - create 231 - update 232 - delete 233 --- 234 Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml 235 kind: ClusterRoleBinding 236 apiVersion: rbac.authorization.k8s.io/v1 237 metadata: 238 name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding 239 roleRef: 240 apiGroup: rbac.authorization.k8s.io 241 kind: ClusterRole 242 name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role 243 subjects: 244 - kind: ServiceAccount 245 name: mongodb-kubernetes-operator 246 namespace: mongodb 247 --- 248 Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml 249 ClusterRoleBinding for clusterVersionDetection 250 kind: ClusterRoleBinding 251 apiVersion: rbac.authorization.k8s.io/v1 252 metadata: 253 name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding 254 roleRef: 255 apiGroup: rbac.authorization.k8s.io 256 kind: ClusterRole 257 name: mongodb-kubernetes-operator-cluster-telemetry 258 subjects: 259 - kind: ServiceAccount 260 name: mongodb-kubernetes-operator 261 namespace: mongodb 262 --- 263 Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml 264 kind: ClusterRoleBinding 265 apiVersion: rbac.authorization.k8s.io/v1 266 metadata: 267 name: mongodb-kubernetes-operator-mongodb-webhook-crb 268 roleRef: 269 apiGroup: rbac.authorization.k8s.io 270 kind: ClusterRole 271 name: mongodb-kubernetes-operator-mongodb-webhook-cr 272 subjects: 273 - kind: ServiceAccount 274 name: mongodb-kubernetes-operator 275 namespace: mongodb 276 --- 277 Source: mongodb-kubernetes/templates/database-roles.yaml 278 kind: Role 279 apiVersion: rbac.authorization.k8s.io/v1 280 metadata: 281 name: mongodb-kubernetes-appdb 282 namespace: mongodb 283 rules: 284 - apiGroups: 285 - '' 286 resources: 287 - secrets 288 verbs: 289 - get 290 - apiGroups: 291 - '' 292 resources: 293 - pods 294 verbs: 295 - patch 296 - delete 297 - get 298 --- 299 Source: mongodb-kubernetes/templates/operator-roles-base.yaml 300 kind: Role 301 apiVersion: rbac.authorization.k8s.io/v1 302 metadata: 303 name: mongodb-kubernetes-operator 304 namespace: mongodb 305 rules: 306 - apiGroups: 307 - '' 308 resources: 309 - services 310 verbs: 311 - get 312 - list 313 - watch 314 - create 315 - update 316 - delete 317 - apiGroups: 318 - '' 319 resources: 320 - secrets 321 - configmaps 322 verbs: 323 - get 324 - list 325 - create 326 - update 327 - delete 328 - watch 329 - apiGroups: 330 - apps 331 resources: 332 - statefulsets 333 verbs: 334 - create 335 - get 336 - list 337 - watch 338 - delete 339 - update 340 - apiGroups: 341 - '' 342 resources: 343 - pods 344 verbs: 345 - get 346 - list 347 - watch 348 - delete 349 - deletecollection 350 - apiGroups: 351 - mongodbcommunity.mongodb.com 352 resources: 353 - mongodbcommunity 354 - mongodbcommunity/status 355 - mongodbcommunity/spec 356 - mongodbcommunity/finalizers 357 verbs: 358 - '*' 359 - apiGroups: 360 - mongodb.com 361 verbs: 362 - '*' 363 resources: 364 - mongodb 365 - mongodb/finalizers 366 - mongodbusers 367 - mongodbusers/finalizers 368 - opsmanagers 369 - opsmanagers/finalizers 370 - mongodbmulticluster 371 - mongodbmulticluster/finalizers 372 - mongodbsearch 373 - mongodbsearch/finalizers 374 - mongodb/status 375 - mongodbusers/status 376 - opsmanagers/status 377 - mongodbmulticluster/status 378 - mongodbsearch/status 379 --- 380 Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml 381 kind: Role 382 apiVersion: rbac.authorization.k8s.io/v1 383 metadata: 384 name: mongodb-kubernetes-operator-pvc-resize 385 namespace: mongodb 386 rules: 387 - apiGroups: 388 - '' 389 resources: 390 - persistentvolumeclaims 391 verbs: 392 - get 393 - delete 394 - list 395 - watch 396 - patch 397 - update 398 --- 399 Source: mongodb-kubernetes/templates/database-roles.yaml 400 kind: RoleBinding 401 apiVersion: rbac.authorization.k8s.io/v1 402 metadata: 403 name: mongodb-kubernetes-appdb 404 namespace: mongodb 405 roleRef: 406 apiGroup: rbac.authorization.k8s.io 407 kind: Role 408 name: mongodb-kubernetes-appdb 409 subjects: 410 - kind: ServiceAccount 411 name: mongodb-kubernetes-appdb 412 namespace: mongodb 413 --- 414 Source: mongodb-kubernetes/templates/operator-roles-base.yaml 415 kind: RoleBinding 416 apiVersion: rbac.authorization.k8s.io/v1 417 metadata: 418 name: mongodb-kubernetes-operator 419 namespace: mongodb 420 roleRef: 421 apiGroup: rbac.authorization.k8s.io 422 kind: Role 423 name: mongodb-kubernetes-operator 424 subjects: 425 - kind: ServiceAccount 426 name: mongodb-kubernetes-operator 427 namespace: mongodb 428 --- 429 Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml 430 kind: RoleBinding 431 apiVersion: rbac.authorization.k8s.io/v1 432 metadata: 433 name: mongodb-kubernetes-operator-pvc-resize-binding 434 namespace: mongodb 435 roleRef: 436 apiGroup: rbac.authorization.k8s.io 437 kind: Role 438 name: mongodb-kubernetes-operator-pvc-resize 439 subjects: 440 - kind: ServiceAccount 441 name: mongodb-kubernetes-operator 442 namespace: mongodb 443 --- 444 Source: mongodb-kubernetes/templates/operator.yaml 445 apiVersion: apps/v1 446 kind: Deployment 447 metadata: 448 name: mongodb-kubernetes-operator 449 namespace: mongodb 450 spec: 451 replicas: 1 452 selector: 453 matchLabels: 454 app.kubernetes.io/component: controller 455 app.kubernetes.io/name: mongodb-kubernetes-operator 456 app.kubernetes.io/instance: mongodb-kubernetes-operator 457 template: 458 metadata: 459 labels: 460 app.kubernetes.io/component: controller 461 app.kubernetes.io/name: mongodb-kubernetes-operator 462 app.kubernetes.io/instance: mongodb-kubernetes-operator 463 spec: 464 serviceAccountName: mongodb-kubernetes-operator 465 securityContext: 466 runAsNonRoot: true 467 runAsUser: 2000 468 containers: 469 - name: mongodb-kubernetes-operator 470 image: "quay.io/mongodb/mongodb-kubernetes:1.6.1" 471 imagePullPolicy: Always 472 args: 473 - -watch-resource=mongodb 474 - -watch-resource=opsmanagers 475 - -watch-resource=mongodbusers 476 - -watch-resource=mongodbcommunity 477 - -watch-resource=mongodbsearch 478 - -watch-resource=clustermongodbroles 479 command: 480 - /usr/local/bin/mongodb-kubernetes-operator 481 resources: 482 limits: 483 cpu: 1100m 484 memory: 1Gi 485 requests: 486 cpu: 500m 487 memory: 200Mi 488 env: 489 - name: OPERATOR_ENV 490 value: prod 491 - name: MDB_DEFAULT_ARCHITECTURE 492 value: non-static 493 - name: NAMESPACE 494 valueFrom: 495 fieldRef: 496 fieldPath: metadata.namespace 497 - name: WATCH_NAMESPACE 498 valueFrom: 499 fieldRef: 500 fieldPath: metadata.namespace 501 - name: MDB_OPERATOR_TELEMETRY_COLLECTION_FREQUENCY 502 value: "1h" 503 - name: MDB_OPERATOR_TELEMETRY_SEND_FREQUENCY 504 value: "168h" 505 - name: CLUSTER_CLIENT_TIMEOUT 506 value: "10" 507 - name: IMAGE_PULL_POLICY 508 value: Always 509 # Database 510 - name: MONGODB_ENTERPRISE_DATABASE_IMAGE 511 value: quay.io/mongodb/mongodb-kubernetes-database 512 - name: INIT_DATABASE_IMAGE_REPOSITORY 513 value: quay.io/mongodb/mongodb-kubernetes-init-database 514 - name: INIT_DATABASE_VERSION 515 value: "1.6.1" 516 - name: DATABASE_VERSION 517 value: "1.6.1" 518 # Ops Manager 519 - name: OPS_MANAGER_IMAGE_REPOSITORY 520 value: quay.io/mongodb/mongodb-enterprise-ops-manager-ubi 521 - name: INIT_OPS_MANAGER_IMAGE_REPOSITORY 522 value: quay.io/mongodb/mongodb-kubernetes-init-ops-manager 523 - name: INIT_OPS_MANAGER_VERSION 524 value: "1.6.1" 525 # AppDB 526 - name: INIT_APPDB_IMAGE_REPOSITORY 527 value: quay.io/mongodb/mongodb-kubernetes-init-appdb 528 - name: INIT_APPDB_VERSION 529 value: "1.6.1" 530 - name: OPS_MANAGER_IMAGE_PULL_POLICY 531 value: Always 532 - name: AGENT_IMAGE 533 value: "quay.io/mongodb/mongodb-agent:108.0.12.8846-1" 534 - name: MDB_AGENT_IMAGE_REPOSITORY 535 value: "quay.io/mongodb/mongodb-agent" 536 - name: MONGODB_IMAGE 537 value: mongodb-enterprise-server 538 - name: MONGODB_REPO_URL 539 value: quay.io/mongodb 540 - name: PERFORM_FAILOVER 541 value: 'true' 542 - name: MDB_MAX_CONCURRENT_RECONCILES 543 value: "1" 544 - name: POD_NAME 545 valueFrom: 546 fieldRef: 547 fieldPath: metadata.name 548 - name: OPERATOR_NAME 549 value: mongodb-kubernetes-operator 550 # Community Env Vars Start 551 - name: MDB_COMMUNITY_AGENT_IMAGE 552 value: "quay.io/mongodb/mongodb-agent:108.0.2.8729-1" 553 - name: VERSION_UPGRADE_HOOK_IMAGE 554 value: "quay.io/mongodb/mongodb-kubernetes-operator-version-upgrade-post-start-hook:1.0.10" 555 - name: READINESS_PROBE_IMAGE 556 value: "quay.io/mongodb/mongodb-kubernetes-readinessprobe:1.0.23" 557 - name: MDB_COMMUNITY_IMAGE 558 value: "mongodb-community-server" 559 - name: MDB_COMMUNITY_REPO_URL 560 value: "quay.io/mongodb" 561 - name: MDB_COMMUNITY_IMAGE_TYPE 562 value: "ubi8" 563 # Community Env Vars End 564 - name: MDB_SEARCH_REPO_URL 565 value: "quay.io/mongodb" 566 - name: MDB_SEARCH_NAME 567 value: "mongodb-search" 568 - name: MDB_SEARCH_VERSION 569 value: "0.55.0"
前面的命令会在 mongodb命名空间中安装Kubernetes Operator；如果该命名空间不存在，则会创建该命名空间。安装后， Kubernetes Operator 会监视 MongoDBSearch 自定义资源并管理MongoDB Search 和 Vector Search 部署的生命周期。
安装MongoDB Search 和 Vector Search
1
必需。创建并加载MongoDB用户密钥。
mongot进程需要身份验证凭证才能连接到外部MongoDB 部署，从而创建搜索索引和运行搜索查询。此步骤将创建以下Kubernetes密钥：
mdb-admin-user-password— MongoDB管理员的凭证。mdb-user-password— 经授权执行搜索查询的用户的凭证。mdbc-rs-search-sync-source-password— 专用搜索用户的凭证，由mongot进程在内部用于同步数据和管理索引。
Kubernetes Operator 将这些密钥挂载到MongoDB Pod 中。
要创建密钥，请在计划部署MongoDB Search 和 Vector Search 的命名空间中复制、粘贴并运行以下命令：
1 Create admin user secret 2 kubectl create secret generic mdb-admin-user-password \ 3 --from-literal=password="${MDB_ADMIN_USER_PASSWORD}" \ 4 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 5 6 Create search sync source user secret 7 kubectl create secret generic "${MDB_RESOURCE_NAME}-search-sync-source-password" \ 8 --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}" \ 9 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 10 11 Create regular user secret 12 kubectl create secret generic mdb-user-password \ 13 --from-literal=password="${MDB_USER_PASSWORD}" \ 14 --dry-run=client -o yaml | kubectl apply --context "${K8S_CTX}" --namespace "${MDB_NS}" -f - 15 16 echo "User secrets created."
1 secret/mdb-admin-user-password created 2 secret/mdbc-rs-search-sync-source-password created 3 secret/mdb-user-password created
2
必需。为MongoDB Search 和 Vector Search 创建并部署资源。
您可以部署一个搜索节点实例，而无需任何负载均衡。要部署，请完成以下步骤：
创建名为
mdbs的 MongoDBSearch 自定义资源。此资源包含以下内容：
spec.source.external.hostAndPorts外部MongoDB副本集节点列表。
spec.source.username搜索同步用户用户名。
spec.source.passwordSecretRef搜索同步用户密码。
spec.source.external.tls.ca.name将 MongoDBSearch Pod 配置为信任外部数据库。它指向Kubernetes密钥，其中包含外部MongoDB的公共 CA 证书。
spec.security.tls.certificateKeySecretRef.name保护 MongoDBSearch 服务。它指向Kubernetes密钥，其中包含 MongoDBSearch Pod 将向传入客户端提供的 TLS服务器证书和私钥。
spec.resourceRequirements搜索容器的 CPU 和内存资源要求。
要学习；了解有关此自定义资源中设置的更多信息，请参阅MongoDB搜索和向量搜索设置。
1 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF 2 apiVersion: mongodb.com/v1 3 kind: MongoDBSearch 4 metadata: 5 name: ${MDB_SEARCH_RESOURCE_NAME:-mdbs} 6 spec: 7 source: 8 external: 9 hostAndPorts: 10 - ${MDB_EXTERNAL_HOST_0} 11 - ${MDB_EXTERNAL_HOST_1} 12 - ${MDB_EXTERNAL_HOST_2} 13 tls: 14 ca: 15 name: ${MDB_TLS_CA_SECRET_NAME} 16 username: search-sync-source 17 passwordSecretRef: 18 name: ${MDB_RESOURCE_NAME}-search-sync-source-password 19 key: password 20 security: 21 tls: 22 certificateKeySecretRef: 23 name: ${MDB_SEARCH_TLS_SECRET_NAME} 24 resourceRequirements: 25 limits: 26 cpu: "3" 27 memory: 5Gi 28 requests: 29 cpu: "2" 30 memory: 3Gi 31 EOF 等待 MongoDBSearch资源部署完成。
当您应用MongoDBSearch 自定义资源时， Kubernetes 操作符开始部署搜索节点 (pod)。此步骤会暂停执行，直到
mdbs资源的状态阶段为Running，这表示MongoDB Search StatefulSet 处于可操作状态。1 echo "Waiting for MongoDBSearch resource to reach Running phase..." 2 3 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait --for=jsonpath='{.status.phase}'=Running mdbs/"${MDB_SEARCH_RESOURCE_NAME:-mdbs}" --timeout=300s
3
必需。为MongoDB Search 和 Vector Search 配置外部访问权限。
启用外部MongoDB实例能够连接到搜索服务，您必须为MongoDB Search 和 Vector Search 配置外部访问权限。您可以创建一个 LoadBalancer 服务，在Kubernetes集群外部公开搜索Pod。
以下服务在端口 27028 上公开 MongoDBSearch 服务，其外部IP解决或主机名可以从Kubernetes集群外部访问。
1 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<YAML 2 apiVersion: v1 3 kind: Service 4 metadata: 5 name: ${MDB_SEARCH_SERVICE_NAME} 6 spec: 7 type: LoadBalancer 8 selector: 9 app: ${MDB_SEARCH_RESOURCE_NAME:-mdbs}-search-svc 10 ports: 11 - name: mongot 12 port: 27028 13 targetPort: 27028 14 YAML 15 16 echo "Waiting for external IP to be assigned to service ${MDB_SEARCH_SERVICE_NAME}..." 17 TIMEOUT=120 # 2 minutes timeout 18 ELAPSED=0 19 while [ ${ELAPSED} -lt ${TIMEOUT} ]; do 20 EXTERNAL_IP=$(kubectl get service "${MDB_SEARCH_SERVICE_NAME}" --context "${K8S_CTX}" -n "${MDB_NS}" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null) 21 if [ -n "${EXTERNAL_IP}" ] && [ "${EXTERNAL_IP}" != "null" ]; then 22 echo "External IP assigned: ${EXTERNAL_IP}" 23 break 24 fi 25 echo "Still waiting for external IP assignment... (${ELAPSED}s/${TIMEOUT}s)" 26 sleep 5 27 ELAPSED=$((ELAPSED + 5)) 28 done 29 30 if [ ${ELAPSED} -ge ${TIMEOUT} ]; then 31 echo "ERROR: Timeout reached (${TIMEOUT}s) while waiting for external IP assignment" 32 echo "LoadBalancer service may take longer to provision or there may be an issue" 33 exit 1 34 fi
4
可选。查看命名空间中所有运行的Pod。
查看MongoDB副本集成员、 Kubernetes Operator 的MongoDB控制器以及搜索节点的命名空间Pod 中运行的所有 Pod。
1 echo; echo "MongoDBSearch resource" 2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbs/mdbs 3 echo; echo "Search pods running in cluster ${K8S_CTX}" 4 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods -l app=mdbs-search-svc 5 echo; echo "All pods in namespace ${MDB_NS}" 6 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods
1 MongoDBSearch resource 2 NAME PHASE VERSION AGE 3 mdbs Running 0.55.0 33s 4 5 Search pods running in cluster kind-kind 6 NAME READY STATUS RESTARTS AGE 7 mdbs-search-0 1/1 Running 0 33s 8 9 All pods in namespace mongodb 10 NAME READY STATUS RESTARTS AGE 11 mdbc-rs-0 2/2 Running 0 3m3s 12 mdbc-rs-1 2/2 Running 0 116s 13 mdbc-rs-2 2/2 Running 0 68s 14 mdbs-search-0 1/1 Running 0 33s 15 mongodb-kubernetes-operator-7bd6cdd889-z9w4z 1/1 Running 0 3m23s
后续步骤
现在，您已成功部署MongoDB Search 和 Vector Search 以与外部MongoDB Enterprise Edition 一起使用，您可以将数据添加到MongoDB 集群，创建MongoDB Search 和 Vector Search 索引，并对数据运行查询。要学习；了解更多信息，请参阅MongoDB搜索和向量搜索设置。