将副本集迁移到Kubernetes

准备Ops Manager或Cloud Manager访问权限。

Create the project ConfigMap and the API key Secret described in the prerequisites.

生成MongoDB自定义资源。

运行 kubectl mongodb migrate-to-mck mongodb 命令：

kubectl mongodb migrate-to-mck mongodb \
  --config-map-name <configmap> \
  --secret-name <secret> \
  --namespace <namespace> \
  -o mongodb-cr.yaml

检查生成的文件。它包含：

• spec.externalMembers，列出源进程。

• spec.members 设置为 0。

• The mongodb.com/migration-dry-run: true annotation, which the plugin always adds.

该命令还支持这些可选标志：

• --certs-secret-prefix: required when TLS is enabled. Sets spec.security.certsSecretPrefix.

• --prometheus-secret-name: use when Prometheus is enabled. The Secret must already exist and have a password key.

• --resource-name-override: sets metadata.name on the generated resource. The plugin normalizes the replica set name automatically when it is not a valid Kubernetes name, and sets spec.replicaSetNameOverride for you.

生成 MongoDBUser 自定义资源。

仅当您要迁移数据库用户时才需完成此步骤。迁移不需要它。

Pre-create one Secret per SCRAM user, each with a password key. Run:

kubectl mongodb migrate-to-mck users \
  --config-map-name <configmap> \
  --secret-name <secret> \
  --namespace <namespace> \
  --users-secrets-file users.csv \
  -o users-cr.yaml

The CSV file maps users to Secrets, one per line, in the form username:database,secret-name. Omit --users-secrets-file to be prompted for each user instead.

该插件根据 $external数据库生成 X.509 和LDAP用户。它会跳过自动化代理用户。

如果部署使用 TLS，请颁发Kubernetes成员证书。

从签署虚拟机证书的同一证书颁发机构颁发Kubernetes成员证书。

Kubernetes Operator expects a kubernetes.io/tls Secret named <certsSecretPrefix>-<resourceName>-cert and a CA ConfigMap named <resourceName>-ca that contains both a ca-pem key and an mms-ca.crt key. The certificates need SANs that cover the per-Pod and Service DNS names, and both server auth and client auth usages.

If the source deployment does not use TLS, set net.tls.mode to disabled in Ops Manager or Cloud Manager, on the existing virtual machine deployment, before you migrate. You do not need to set anything in the MongoDB custom resource for this case.

配置外部访问权限。

Before you run the dry run, configure spec.externalAccess so that the virtual machine members can reach the Kubernetes Pods. To let those members resolve the Pods by hostname, you can also set spec.externalAccess.externalDomain. To learn about the fields involved and the DNS requirements, see Network Requirements for Migration.

此设置由用户所有：您可以为您的环境配置 LoadBalancer 或 NodePort 以及 DNS 记录。

运行运行并检查连接性。

Apply the generated resource with the mongodb.com/migration-dry-run annotation still present. While the annotation is set, Kubernetes Operator makes no automation config changes and only validates connectivity.

Kubernetes Operator creates a Job named <resourceName>-connectivity-check, which dials every external member and authenticates. The Job deletes itself using ttlSecondsAfterFinished, and the next reconcile re-creates it, so re-validation is automatic. You can fix problems in Kubernetes or in the Ops Manager UI and re-run freely.

The dry run checks Kubernetes-to-virtual-machine reachability (DNS, TLS, firewalls, and member addresses) and credentials, including the __system role on the local database, and the CA when TLS is enabled. It does not check virtual-machine-to-Kubernetes inbound connectivity.

由于该方向完全取决于您的网络设置，因此没有任何单个命令可以保证这一方向。相反，请仔细检查此清单：

• Confirm that the hostnames the Kubernetes members will have, following the pattern <metadata.name>-0.<spec.externalAccess.externalDomain>, are resolvable from the virtual machine members.

• 确认可从虚拟机访问Kubernetes节点或 LoadBalancer IP。

Read the result from status.conditions[type=NetworkConnectivityVerified]:

Failures that occur before the Job starts use the reasons OperatorImageUnknown, BuildStatefulSetOptions, AgentCertSecretFailed, and AgentCertSubject.

Kubernetes Operator removes the NetworkConnectivityVerified condition from status.conditions entirely once no external members remain.

将副本集扩展到Kubernetes。

删除试运行注解：

kubectl annotate mdb <resourceName> \
  mongodb.com/migration-dry-run-

This is the point at which Kubernetes Operator takes ownership of the Ops Manager project.

Raise spec.members and hand-write spec.memberConfig together.

示例，要添加三个Kubernetes成员作为无投票权：

spec:
  memberConfig:
    - votes: 0
      priority: "0"
    - votes: 0
      priority: "0"
    - votes: 0
      priority: "0"

Wait for full initial sync and goal state. If you generated MongoDBUser resources in the optional step above, apply them now and confirm each one reaches a status.phase of Updated.

提升Kubernetes成员。

Shift votes and priority onto the Kubernetes members by editing spec.memberConfig. votes is an integer. priority is a string containing a float.

External members keep whatever votes and priority they carry in the source automation config. spec.externalMembers has no votes or priority field.

等待目标状态。

修剪外部成员。

例如：

kubectl patch mdb <resourceName> --type=json \
  -p='[{"op":"remove","path":"/spec/externalMembers/0"}]'

您可以删除条目，但一旦迁移开始就永远不能添加。

Watch status.conditions[type=Migrating].reason move through Extending, InProgress, and Pruning:

Precedence is Validating > Extending > Pruning > InProgress. A prune that also grows the Kubernetes side reports Extending, which is another reason to make one change at a time.

不允许同时进行剪枝和扩展。

To script against migration completion, use kubectl wait --for=condition=Migrating=False rather than polling status.phase.

验证并完成。

Migration is complete when spec.externalMembers is empty, the Migrating condition is False with reason MigrationComplete, and all data lives in persistent volume claims:

kubectl wait --for=condition=Migrating=False mdb/<resourceName>

更新应用程序连接字符串并停用虚拟机。 Kubernetes Operator 不会为您停用虚拟机。