When you migrate a TLS-enabled replica set from virtual machines into Kubernetes, one replica set is one trust domain. Issue the Kubernetes member certificates from the same certificate authority (CA) that signed the virtual machine certificates. This is the only migration-specific TLS requirement. The general TLS documentation for Kubernetes Operator covers everything else about configuring TLS. A CA mismatch fails the dry run, by design. To learn how the dry run surfaces that failure, see Validate Migration Readiness with a Dry Run.
重要
此页面上的字段仅用于迁移。除非字段说明另有说明，否则请勿在新建的Kubernetes Operator部署上设立它们。
关于此任务
To learn how to issue certificates, structure Secrets and ConfigMaps, and configure the general TLS settings on the MongoDB custom resource, see:
Security Settings for the full list of
spec.security.tlsand related fields.Set Up a cert-manager Integration to issue certificates with
cert-manager.生成 X.509 客户端证书以手动颁发证书。
When you follow that documentation for a migration, issue the Kubernetes member certificates from the same CA that signed the virtual machine certificates, not from a new CA. The CA ConfigMap named <resourceName>-ca must contain a ca-pem key populated from that same CA.
开始之前
您需要满足以下条件：
虚拟机部署的现有 CA 证书和密钥材料。
cert-manager或等效工具，以从同一 CA 颁发Kubernetes成员证书。The generated
MongoDBcustom resource from Migrate a Replica Set to Kubernetes.
步骤
从源 CA 创建证书和 CA 资源。
按照“设置证书管理器集成”或“生成 X.509 客户端证书”操作，创建名为 <certsSecretPrefix>-<resourceName>-cert 的 kubernetes.io/tls Secret，从签署虚拟机证书的同一 CA 颁发证书。
Create the CA ConfigMap named <resourceName>-ca with a ca-pem key populated from that same CA.
如果使用 X.509代理身份验证，还要创建 <certsSecretPrefix>-<resourceName>-agent-certs Secret 并设立spec.security.authentication.agents.clientCertificateSecretRef 以引用它。此要求仅适用于代理身份验证，不适用于内部集群身份验证(spec.security.authentication.internalCluster)。
设置路径兼容性字段以匹配源部署。
这些字段的存在只是为了使Kubernetes Operator 的文件路径视图与虚拟机部署已布局其证书和密钥文件的方式相匹配。仅设置应用于源部署的设置：
spec.security.tls.caFilePath: the absolute path the CA is projected to inside the Pod. Defaults to/mongodb-automation/tls/ca/ca-pem. The path must contain at least two path segments. This field is not supported for the Application Database. If yourpodTemplatemounts another volume over this path, that mount shadows the projected CA and the Ops Manager Agent cannot read it.spec.security.authentication.agents.autoPEMKeyFilePath: the absolute path of the agent's combined PEM file inside database Pods. This field configures agent authentication only. Setting this field sets the Ops Managertls.autoPEMKeyFilePathvalue and mounts theSecretreferenced byclientCertificateSecretRefat that path. It defaults to a hash-derived agent certificate mount path, and setting it requiresspec.security.authentication.agents.clientCertificateSecretRefto already be set. Set this field only when the virtual machine deployment uses a non-default agent PEM path.spec.downloadBase: the directory where the Ops Manager Agent binary downloads. Defaults to/var/lib/mongodb-mms-automation. Kubernetes Operator derives the keyfile path from this value as<downloadBase>/keyfile.
如果源部署未使用 TLS，请在源部署上禁用 TLS。
If the virtual machine deployment never configured TLS, set net.tls.mode to disabled in Ops Manager or Cloud Manager on the existing virtual machine deployment before you migrate. Do not set this field on the MongoDB custom resource.
If you leave the source deployment's TLS mode unset, Kubernetes Operator attempts a deployment change that does not match the source automation config, because its default view of TLS differs from a deployment that never configured TLS at all. Setting the field to disabled on the source deployment makes Kubernetes Operator's view match the virtual machine deployment and avoids that spurious change.
运行运行运行以确认 CA 匹配。
Apply the resource with the dry-run annotation still present and check the NetworkConnectivityVerified condition. To learn how to read the result and what to do if it fails, see Validate Migration Readiness with a Dry Run.
对于分片集群
A sharded cluster needs one certificate per component, following the pattern <resourceName>-config-* for the config server, <resourceName>-<shardIndex>-* for each shard, and <resourceName>-mongos-* for the mongos routers.
注意
Confirm the exact per-component Secret names against the generated resource before you reconcile. To learn how a sharded cluster migration differs from a replica set migration, see Migrate a Sharded Cluster to Kubernetes.