/ /

部署搜索和向量搜索

Docs 主页

/ /

适用于Kubernetes Operator 的MongoDB控制器

部署搜索和向量搜索

Docs 主页

管理

Kubernetes Operator 的控制器

适用于Kubernetes Operator 的MongoDB控制器

部署搜索和向量搜索

安装和使用MongoDB Search 和 Vector Search With external MongoDB Enterprise Edition

支持使用Kubernetes 操作符部署MongoDB Search 和MongoDB Vector Search 是作为 Preview功能提供的。在预览期间，功能和相应的文档可能随时更改。要学习；了解详情，请参阅预览功能。

您可以使用Kubernetes Operator 在Kubernetes集群上部署MongoDB Search 和 Vector Search，与外部MongoDB Enterprise Edition v8.0.10 或更高版本的服务器一起运行。此过程演示如何在Kubernetes集群中部署和配置 mongot进程，以使用新的或现有的外部副本集部署。

先决条件

要部署MongoDB Search 和 Vector Search，您必须具备以下条件：

一个运行的Kubernetes集群，且本地可用 kubeconfig。
Kubernetes命令行工具 kubectl，配置为与集群通信。
Helm（ Kubernetes的包管理器），用于安装Kubernetes Operator。
Bash v5.1 或更高版本，用于运行本教程中的命令。
运行8.0.10 或更高版本的MongoDB Enterprise Edition副本集，用于存储数据。
要学习；了解有关部署MongoDB Enterprise 的更多信息，请参阅部署和配置MongoDB数据库资源。
运行的MongoDB Cloud Manager或MongoDB Ops Manager ，用于管理MongoDB任务。

开始之前

在使用Kubernetes Operator 安装MongoDB Search 和 Vector Search 之前，您必须执行以下操作：

为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager参数
为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager用户
设置您的环境

为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager参数

登录到Cloud Manager或MongoDB Ops Manager用户界面并执行以下步骤，为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager 。

GoCloud Manager或MongoDB Ops Manager Deployment 页面。

登录MongoDB Cloud Manager或MongoDB Ops Manager。
单击 Deployment 标签页。
选择要修改的集群。

修改Cloud Manager或MongoDB Ops Manager部署配置。

单击 Modify 按钮打开部署配置编辑器。
在 Process Configuration（添加特性和功能）部分下，单击 Advanced Configuration Options（权限）。
单击 Add Option 按钮，然后从下拉列表中选择 setParameter Startup Option。

添加名称和值后，单击 Add，在字段中逐个添加以下参数：

Parameter	值
`mongotHost`	您的搜索主机名和端口。示例：`search-node1.example.com:27017`。
`searchIndexManagementHostAndPort`	您的搜索主机名和端口。示例：`search-node1.example.com:27017`。
`skipAuthenticationToSearchIndexManagementServer`	`false`
`searchTLSMode`	您配置的 TLS模式。示例，如果 `mongot`进程配置为接受 TLS 连接，则为 `preferTLS`。

查看并部署更改。

单击 Review & Deploy 按钮。
查看并确认以应用更改。
Cloud Manager或MongoDB Ops Manager对副本集执行滚动重启以应用新配置。

为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager用户

您必须创建具有 searchCoordinator角色的用户。在MongoDB 8.2 及更高版本中，searchCoordinator 是一个内置角色。您必须创建一个用户并为该用户分配角色。对于 8.2 和 8.0.10 之前或更高版本的MongoDB版本，您必须在创建用户之前手动创建角色并分配权限。选择与您运行的MongoDB版本对应的标签页，创建具有 searchCoordinator角色的用户。

MongoDB 8.2 或更高版本

如果您使用MongoDB 8.2 或更高版本，请完成本部分中的步骤。

要创建用户并为其内置searchCoordinator角色，请使用Cloud Manager或MongoDB Ops Manager用户界面或mongosh完成以下步骤：

转到 Users（快速入门）页面。

登录Cloud Manager或MongoDB Ops Manager用户界面。
GoSecurity标签页并单击 Users。

单击 Add New User（保存并关闭）。

为用户设置凭证。

Username	输入 `search-sync-source`。
Password	设置安全强度高的密码。
Authentication Database	选择 `admin`数据库。

将`searchCoordinator` 角色分配给用户。

在 Assign Roles 部分，从 admin数据库的下拉列表中选择内置searchCoordinator角色。

Add User单击创建具有`searchCoordinator` 角色的用户。

在 mongosh 中，运行以下命令：

切换到 `admin` 数据库。

use admin;

将密码替换为安全密码后，运行以下命令以创建用户。

db.createUser({
   user: "search-sync-source",
   pwd: "<PASSWORD>", // Replace with your actual password
   roles: [
      { role: "searchCoordinator", db: "admin" }
   ]
});

8.2 之前的MongoDB版本

如果您使用 8.2 之前的MongoDB版本，请完成本部分中的步骤。

要创建用户并为其内置searchCoordinator角色，请使用Cloud Manager或MongoDB Ops Manager用户界面或mongosh完成以下步骤：

转到 Roles（快速入门）页面。

登录Cloud Manager或MongoDB Ops Manager用户界面。
在 Security标签页下，GoRoles 子标签页。
单击 Add New Custom Role（连接）。

将 Role Name 设置为 `searchCoordinator`。

指定要继承的角色。

在 Role Inheritance 部分中，从 admin数据库添加以下三个角色：

clusterMonitor
directShardOperations
readAnyDatabase

添加要分配给该角色的数据库权限。

在 Privileges 部分中，单击 Add Privilege。
对于 Resource，输入数据库的 __mdb_internal_search。
不要在集合字段中输入任何内容。
在 Actions 下，添加以下操作。
- changeStream
- cleanupStructuredEncryptionData, compactStructuredEncryptionData
- collStats
- convertToCapped
- createCollection, dropCollection , listCollections , renameCollectionSameDB
- createIndex, dropIndex , listIndexes
- createSearchIndexes, dropSearchIndex , listSearchIndexes , updateSearchIndex
- dbHash, dbStats
- find, insert , remove , update
- killCursors
- planCacheRead

配置集群权限。

单击 Add Privilege（连接）。
对于 Resource，将资源类型切换为 cluster。
对于 Action（Atlas 问题类别），选择 bypassDefaultMaxTimeMS（其他）。

查看所有设置并单击Create Role 。

转到 Users（快速入门）页面。

GoSecurity标签页并单击 Users。

单击 Add New User（保存并关闭）。

为用户设置凭证。

Username	输入 `search-sync-source`。
Password	设置安全强度高的密码。
Authentication Database	选择 `admin`数据库。

将`searchCoordinator` 角色分配给用户。

在 Assign Roles 部分，从 admin数据库的下拉列表中选择内置searchCoordinator角色。

在 mongosh 中，运行以下命令：

切换到 `admin` 数据库。

use admin;

创建自定义角色。

db.createRole({
   role: "searchCoordinator",
   privileges: [
      {
         resource: { db: "__mdb_internal_search", collection: "" },
         actions: [
            "changeStream", "cleanupStructuredEncryptionData", "collStats",
            "compactStructuredEncryptionData", "convertToCapped", "createCollection",
            "createIndex", "createSearchIndexes", "dbHash", "dbStats",
            "dropCollection", "dropIndex", "dropSearchIndex", "find", "insert",
            "killCursors", "listCollections", "listIndexes", "listSearchIndexes",
            "planCacheRead", "remove", "renameCollectionSameDB", "update", "updateSearchIndex"
         ]
      },
      {
         resource: { cluster: true },
         actions: [ "bypassDefaultMaxTimeMS" ]
      }
   ],
   roles: [
      { role: "clusterMonitor", db: "admin" },
      { role: "directShardOperations", db: "admin" },
      { role: "readAnyDatabase", db: "admin" }
   ]
});

将密码替换为安全密码后，运行以下命令以创建用户。

db.createUser({
   user: "search-sync-source",
   pwd: "<PASSWORD>", // Replace with your actual password
   roles: [
      { role: "searchCoordinator", db: "admin" }
   ]
});

设置您的环境

准备环境，以便在终端中运行本教程中的示例代码。

必填。设置环境变量。

要设立用于此过程后续步骤的环境变量，请复制以下内容，设立环境变量的值，然后加载环境变量：

1 export K8S_CTX="<your kubernetes context here>"
2 
3 export MDB_NS="mongodb"
4 
5 export MDB_VERSION="8.0.10"
6 
7 export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
8 export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
9 export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
10 
11 export MDB_SEARCH_HOSTNAME="mdbs-search"
12 
13 # External MongoDB replica set members - REPLACE THESE VALUES with your actual external MongoDB hosts
14 # In production, replace with your actual external MongoDB replica set members
15 export MDB_EXTERNAL_HOST_0="mdbc-rs-0.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
16 export MDB_EXTERNAL_HOST_1="mdbc-rs-1.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
17 export MDB_EXTERNAL_HOST_2="mdbc-rs-2.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
18 
19 # REPLACE with your external MongoDB keyfile secret name
20 export MDB_EXTERNAL_KEYFILE_SECRET_NAME="mdbc-rs-keyfile"
21 
22 # REPLACE with the actual keyfile content from your external MongoDB replica set
23 # For testing, this will be automatically generated by the MongoDB Community resource
24 export MDB_EXTERNAL_KEYFILE_CONTENT="your-mongodb-keyfile-content-CHANGE-ME"
25 
26 # REPLACE with your actual external MongoDB replica set name
27 export MDB_EXTERNAL_REPLICA_SET_NAME="mdbc-rs"
28 
29 export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes"
30 export OPERATOR_ADDITIONAL_HELM_VALUES=""
31 
32 export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_EXTERNAL_HOST_0}/?replicaSet=${MDB_EXTERNAL_REPLICA_SET_NAME}"

有条件。添加MongoDB Helm存储库。

Helm 可自动部署和管理Kubernetes上的MongoDB实例。如果您已经添加了包含用于安装Kubernetes Operator 操作符的Helm图表的Helm存储库，请跳过此步骤。否则，请添加Helm存储库。

要添加、复制、粘贴并运行以下命令：

1 helm repo add mongodb https://mongodb.github.io/helm-charts
2 helm repo update mongodb
3 helm search repo mongodb/mongodb-kubernetes

1 "mongodb" already exists with the same configuration, skipping
2 Hang tight while we grab the latest from your chart repositories...
3 ...Successfully got an update from the "mongodb" chart repository
4 Update Complete. ⎈Happy Helming!⎈
5 NAME                      	CHART VERSION	APP VERSION	DESCRIPTION                                       
6 mongodb/mongodb-kubernetes	1.3.0        	           	MongoDB Controllers for Kubernetes translate th...

有条件。为Kubernetes Operator 安装MongoDB控制器。

Kubernetes Operator 监视 MongoDB、MongoDBOpsManager 和 MongoDBSearch 自定义资源，并管理MongoDB部署的生命周期。如果您已经安装了MongoDB Controllers for Kubernetes Operator，请跳过此步骤。否则，请从您在上一步中添加的Helm存储库安装MongoDB Controllers for Kubernetes Operator。

要在 mongodb命名空间中安装MongoDB Controllers for Kubernetes Operator，请复制、粘贴并运行以下命令：

1 helm upgrade --install --debug --kube-context "${K8S_CTX}" \
2   --create-namespace \
3   --namespace="${MDB_NS}" \
4   mongodb-kubernetes \
5   ${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
6   "${OPERATOR_HELM_CHART}"

1 Release "mongodb-kubernetes" does not exist. Installing it now.
2 NAME: mongodb-kubernetes
3 LAST DEPLOYED: Tue Sep 16 14:11:48 2025
4 NAMESPACE: mongodb
5 STATUS: deployed
6 REVISION: 1
7 TEST SUITE: None
8 USER-SUPPLIED VALUES:
9 {}
10 
11 COMPUTED VALUES:
12 agent:
13   name: mongodb-agent
14   version: 108.0.12.8846-1
15 community:
16   agent:
17     name: mongodb-agent
18     version: 108.0.2.8729-1
19   mongodb:
20     imageType: ubi8
21     name: mongodb-community-server
22     repo: quay.io/mongodb
23   registry:
24     agent: quay.io/mongodb
25   resource:
26     members: 3
27     name: mongodb-replica-set
28     tls:
29       caCertificateSecretRef: tls-ca-key-pair
30       certManager:
31         certDuration: 8760h
32         renewCertBefore: 720h
33       certificateKeySecretRef: tls-certificate
34       enabled: false
35       sampleX509User: false
36       useCertManager: true
37       useX509: false
38     version: 4.4.0
39 database:
40   name: mongodb-kubernetes-database
41   version: 1.4.0
42 initAppDb:
43   name: mongodb-kubernetes-init-appdb
44   version: 1.4.0
45 initDatabase:
46   name: mongodb-kubernetes-init-database
47   version: 1.4.0
48 initOpsManager:
49   name: mongodb-kubernetes-init-ops-manager
50   version: 1.4.0
51 managedSecurityContext: false
52 mongodb:
53   appdbAssumeOldFormat: false
54   imageType: ubi8
55   name: mongodb-enterprise-server
56   repo: quay.io/mongodb
57 multiCluster:
58   clusterClientTimeout: 10
59   clusters: []
60   kubeConfigSecretName: mongodb-enterprise-operator-multi-cluster-kubeconfig
61   performFailOver: true
62 operator:
63   additionalArguments: []
64   affinity: {}
65   baseName: mongodb-kubernetes
66   createOperatorServiceAccount: true
67   createResourcesServiceAccountsAndRoles: true
68   deployment_name: mongodb-kubernetes-operator
69   enableClusterMongoDBRoles: true
70   enablePVCResize: true
71   env: prod
72   maxConcurrentReconciles: 1
73   mdbDefaultArchitecture: non-static
74   name: mongodb-kubernetes-operator
75   nodeSelector: {}
76   operator_image_name: mongodb-kubernetes
77   replicas: 1
78   resources:
79     limits:
80       cpu: 1100m
81       memory: 1Gi
82     requests:
83       cpu: 500m
84       memory: 200Mi
85   telemetry:
86     collection:
87       clusters: {}
88       deployments: {}
89       frequency: 1h
90       operators: {}
91     send:
92       frequency: 168h
93   tolerations: []
94   vaultSecretBackend:
95     enabled: false
96     tlsSecretRef: ""
97   version: 1.4.0
98   watchedResources:
99   - mongodb
100   - opsmanagers
101   - mongodbusers
102   - mongodbcommunity
103   - mongodbsearch
104   webhook:
105     installClusterRole: true
106     registerConfiguration: true
107 opsManager:
108   name: mongodb-enterprise-ops-manager-ubi
109 readinessProbe:
110   name: mongodb-kubernetes-readinessprobe
111   version: 1.0.22
112 registry:
113   agent: quay.io/mongodb
114   database: quay.io/mongodb
115   imagePullSecrets: null
116   initAppDb: quay.io/mongodb
117   initDatabase: quay.io/mongodb
118   initOpsManager: quay.io/mongodb
119   operator: quay.io/mongodb
120   opsManager: quay.io/mongodb
121   pullPolicy: Always
122   readinessProbe: quay.io/mongodb
123   versionUpgradeHook: quay.io/mongodb
124 search:
125   name: mongodb-search
126   repo: quay.io/mongodb
127   version: 0.53.1
128 versionUpgradeHook:
129   name: mongodb-kubernetes-operator-version-upgrade-post-start-hook
130   version: 1.0.9
131 
132 HOOKS:
133 MANIFEST:
134 ---
135 # Source: mongodb-kubernetes/templates/database-roles.yaml
136 apiVersion: v1
137 kind: ServiceAccount
138 metadata:
139   name: mongodb-kubernetes-appdb
140   namespace: mongodb
141 ---
142 # Source: mongodb-kubernetes/templates/database-roles.yaml
143 apiVersion: v1
144 kind: ServiceAccount
145 metadata:
146   name: mongodb-kubernetes-database-pods
147   namespace: mongodb
148 ---
149 # Source: mongodb-kubernetes/templates/database-roles.yaml
150 apiVersion: v1
151 kind: ServiceAccount
152 metadata:
153   name: mongodb-kubernetes-ops-manager
154   namespace: mongodb
155 ---
156 # Source: mongodb-kubernetes/templates/operator-sa.yaml
157 apiVersion: v1
158 kind: ServiceAccount
159 metadata:
160   name: mongodb-kubernetes-operator
161   namespace: mongodb
162 ---
163 # Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
164 kind: ClusterRole
165 apiVersion: rbac.authorization.k8s.io/v1
166 metadata:
167   name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
168 rules:
169   - apiGroups:
170       - mongodb.com
171     verbs:
172       - '*'
173     resources:
174       - clustermongodbroles
175 ---
176 # Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
177 # Additional ClusterRole for clusterVersionDetection
178 kind: ClusterRole
179 apiVersion: rbac.authorization.k8s.io/v1
180 metadata:
181   name: mongodb-kubernetes-operator-cluster-telemetry
182 rules:
183   # Non-resource URL permissions
184   - nonResourceURLs:
185       - "/version"
186     verbs:
187       - get
188   # Cluster-scoped resource permissions
189   - apiGroups:
190       - ''
191     resources:
192       - namespaces
193     resourceNames:
194       - kube-system
195     verbs:
196       - get
197   - apiGroups:
198       - ''
199     resources:
200       - nodes
201     verbs:
202       - list
203 ---
204 # Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
205 kind: ClusterRole
206 apiVersion: rbac.authorization.k8s.io/v1
207 metadata:
208   name: mongodb-kubernetes-operator-mongodb-webhook-cr
209 rules:
210   - apiGroups:
211       - "admissionregistration.k8s.io"
212     resources:
213       - validatingwebhookconfigurations
214     verbs:
215       - get
216       - create
217       - update
218       - delete
219   - apiGroups:
220       - ""
221     resources:
222       - services
223     verbs:
224       - get
225       - list
226       - watch
227       - create
228       - update
229       - delete
230 ---
231 # Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
232 kind: ClusterRoleBinding
233 apiVersion: rbac.authorization.k8s.io/v1
234 metadata:
235   name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
236 roleRef:
237   apiGroup: rbac.authorization.k8s.io
238   kind: ClusterRole
239   name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
240 subjects:
241   - kind: ServiceAccount
242     name: mongodb-kubernetes-operator
243     namespace: mongodb
244 ---
245 # Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
246 # ClusterRoleBinding for clusterVersionDetection
247 kind: ClusterRoleBinding
248 apiVersion: rbac.authorization.k8s.io/v1
249 metadata:
250   name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
251 roleRef:
252   apiGroup: rbac.authorization.k8s.io
253   kind: ClusterRole
254   name: mongodb-kubernetes-operator-cluster-telemetry
255 subjects:
256   - kind: ServiceAccount
257     name: mongodb-kubernetes-operator
258     namespace: mongodb
259 ---
260 # Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
261 kind: ClusterRoleBinding
262 apiVersion: rbac.authorization.k8s.io/v1
263 metadata:
264   name: mongodb-kubernetes-operator-mongodb-webhook-crb
265 roleRef:
266   apiGroup: rbac.authorization.k8s.io
267   kind: ClusterRole
268   name: mongodb-kubernetes-operator-mongodb-webhook-cr
269 subjects:
270   - kind: ServiceAccount
271     name: mongodb-kubernetes-operator
272     namespace: mongodb
273 ---
274 # Source: mongodb-kubernetes/templates/database-roles.yaml
275 kind: Role
276 apiVersion: rbac.authorization.k8s.io/v1
277 metadata:
278   name: mongodb-kubernetes-appdb
279   namespace: mongodb
280 rules:
281   - apiGroups:
282       - ''
283     resources:
284       - secrets
285     verbs:
286       - get
287   - apiGroups:
288       - ''
289     resources:
290       - pods
291     verbs:
292       - patch
293       - delete
294       - get
295 ---
296 # Source: mongodb-kubernetes/templates/operator-roles-base.yaml
297 kind: Role
298 apiVersion: rbac.authorization.k8s.io/v1
299 metadata:
300   name: mongodb-kubernetes-operator
301   namespace: mongodb
302 rules:
303   - apiGroups:
304       - ''
305     resources:
306       - services
307     verbs:
308       - get
309       - list
310       - watch
311       - create
312       - update
313       - delete
314   - apiGroups:
315       - ''
316     resources:
317       - secrets
318       - configmaps
319     verbs:
320       - get
321       - list
322       - create
323       - update
324       - delete
325       - watch
326   - apiGroups:
327       - apps
328     resources:
329       - statefulsets
330     verbs:
331       - create
332       - get
333       - list
334       - watch
335       - delete
336       - update
337   - apiGroups:
338       - ''
339     resources:
340       - pods
341     verbs:
342       - get
343       - list
344       - watch
345       - delete
346       - deletecollection
347   - apiGroups:
348       - mongodbcommunity.mongodb.com
349     resources:
350       - mongodbcommunity
351       - mongodbcommunity/status
352       - mongodbcommunity/spec
353       - mongodbcommunity/finalizers
354     verbs:
355       - '*'
356   - apiGroups:
357       - mongodb.com
358     verbs:
359       - '*'
360     resources:
361       - mongodb
362       - mongodb/finalizers
363       - mongodbusers
364       - mongodbusers/finalizers
365       - opsmanagers
366       - opsmanagers/finalizers
367       - mongodbmulticluster
368       - mongodbmulticluster/finalizers
369       - mongodbsearch
370       - mongodbsearch/finalizers
371       - mongodb/status
372       - mongodbusers/status
373       - opsmanagers/status
374       - mongodbmulticluster/status
375       - mongodbsearch/status
376 ---
377 # Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
378 kind: Role
379 apiVersion: rbac.authorization.k8s.io/v1
380 metadata:
381   name: mongodb-kubernetes-operator-pvc-resize
382   namespace: mongodb
383 rules:
384   - apiGroups:
385       - ''
386     resources:
387       - persistentvolumeclaims
388     verbs:
389       - get
390       - delete
391       - list
392       - watch
393       - patch
394       - update
395 ---
396 # Source: mongodb-kubernetes/templates/database-roles.yaml
397 kind: RoleBinding
398 apiVersion: rbac.authorization.k8s.io/v1
399 metadata:
400   name: mongodb-kubernetes-appdb
401   namespace: mongodb
402 roleRef:
403   apiGroup: rbac.authorization.k8s.io
404   kind: Role
405   name: mongodb-kubernetes-appdb
406 subjects:
407   - kind: ServiceAccount
408     name: mongodb-kubernetes-appdb
409     namespace: mongodb
410 ---
411 # Source: mongodb-kubernetes/templates/operator-roles-base.yaml
412 kind: RoleBinding
413 apiVersion: rbac.authorization.k8s.io/v1
414 metadata:
415   name: mongodb-kubernetes-operator
416   namespace: mongodb
417 roleRef:
418   apiGroup: rbac.authorization.k8s.io
419   kind: Role
420   name: mongodb-kubernetes-operator
421 subjects:
422   - kind: ServiceAccount
423     name: mongodb-kubernetes-operator
424     namespace: mongodb
425 ---
426 # Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
427 kind: RoleBinding
428 apiVersion: rbac.authorization.k8s.io/v1
429 metadata:
430   name: mongodb-kubernetes-operator-pvc-resize-binding
431   namespace: mongodb
432 roleRef:
433   apiGroup: rbac.authorization.k8s.io
434   kind: Role
435   name: mongodb-kubernetes-operator-pvc-resize
436 subjects:
437   - kind: ServiceAccount
438     name: mongodb-kubernetes-operator
439     namespace: mongodb
440 ---
441 # Source: mongodb-kubernetes/templates/operator.yaml
442 apiVersion: apps/v1
443 kind: Deployment
444 metadata:
445   name: mongodb-kubernetes-operator
446   namespace: mongodb
447 spec:
448   replicas: 1
449   selector:
450     matchLabels:
451       app.kubernetes.io/component: controller
452       app.kubernetes.io/name: mongodb-kubernetes-operator
453       app.kubernetes.io/instance: mongodb-kubernetes-operator
454   template:
455     metadata:
456       labels:
457         app.kubernetes.io/component: controller
458         app.kubernetes.io/name: mongodb-kubernetes-operator
459         app.kubernetes.io/instance: mongodb-kubernetes-operator
460     spec:
461       serviceAccountName: mongodb-kubernetes-operator
462       securityContext:
463         runAsNonRoot: true
464         runAsUser: 2000
465       containers:
466         - name: mongodb-kubernetes-operator
467           image: "quay.io/mongodb/mongodb-kubernetes:1.4.0"
468           imagePullPolicy: Always
469           args:
470             - -watch-resource=mongodb
471             - -watch-resource=opsmanagers
472             - -watch-resource=mongodbusers
473             - -watch-resource=mongodbcommunity
474             - -watch-resource=mongodbsearch
475             - -watch-resource=clustermongodbroles
476           command:
477             - /usr/local/bin/mongodb-kubernetes-operator
478           resources:
479             limits:
480               cpu: 1100m
481               memory: 1Gi
482             requests:
483               cpu: 500m
484               memory: 200Mi
485           env:
486             - name: OPERATOR_ENV
487               value: prod
488             - name: MDB_DEFAULT_ARCHITECTURE
489               value: non-static
490             - name: NAMESPACE
491               valueFrom:
492                 fieldRef:
493                   fieldPath: metadata.namespace
494             - name: WATCH_NAMESPACE
495               valueFrom:
496                 fieldRef:
497                   fieldPath: metadata.namespace
498             - name: MDB_OPERATOR_TELEMETRY_COLLECTION_FREQUENCY
499               value: "1h"
500             - name: MDB_OPERATOR_TELEMETRY_SEND_FREQUENCY
501               value: "168h"
502             - name: CLUSTER_CLIENT_TIMEOUT
503               value: "10"
504             - name: IMAGE_PULL_POLICY
505               value: Always
506             # Database
507             - name: MONGODB_ENTERPRISE_DATABASE_IMAGE
508               value: quay.io/mongodb/mongodb-kubernetes-database
509             - name: INIT_DATABASE_IMAGE_REPOSITORY
510               value: quay.io/mongodb/mongodb-kubernetes-init-database
511             - name: INIT_DATABASE_VERSION
512               value: 1.4.0
513             - name: DATABASE_VERSION
514               value: 1.4.0
515             # Ops Manager
516             - name: OPS_MANAGER_IMAGE_REPOSITORY
517               value: quay.io/mongodb/mongodb-enterprise-ops-manager-ubi
518             - name: INIT_OPS_MANAGER_IMAGE_REPOSITORY
519               value: quay.io/mongodb/mongodb-kubernetes-init-ops-manager
520             - name: INIT_OPS_MANAGER_VERSION
521               value: 1.4.0
522             # AppDB
523             - name: INIT_APPDB_IMAGE_REPOSITORY
524               value: quay.io/mongodb/mongodb-kubernetes-init-appdb
525             - name: INIT_APPDB_VERSION
526               value: 1.4.0
527             - name: OPS_MANAGER_IMAGE_PULL_POLICY
528               value: Always
529             - name: AGENT_IMAGE
530               value: "quay.io/mongodb/mongodb-agent:108.0.12.8846-1"
531             - name: MDB_AGENT_IMAGE_REPOSITORY
532               value: "quay.io/mongodb/mongodb-agent"
533             - name: MONGODB_IMAGE
534               value: mongodb-enterprise-server
535             - name: MONGODB_REPO_URL
536               value: quay.io/mongodb
537             - name: MDB_IMAGE_TYPE
538               value: ubi8
539             - name: PERFORM_FAILOVER
540               value: 'true'
541             - name: MDB_MAX_CONCURRENT_RECONCILES
542               value: "1"
543             - name: POD_NAME
544               valueFrom:
545                 fieldRef:
546                   fieldPath: metadata.name
547             - name: OPERATOR_NAME
548               value: mongodb-kubernetes-operator
549             # Community Env Vars Start
550             - name: MDB_COMMUNITY_AGENT_IMAGE
551               value: "quay.io/mongodb/mongodb-agent:108.0.2.8729-1"
552             - name: VERSION_UPGRADE_HOOK_IMAGE
553               value: "quay.io/mongodb/mongodb-kubernetes-operator-version-upgrade-post-start-hook:1.0.9"
554             - name: READINESS_PROBE_IMAGE
555               value: "quay.io/mongodb/mongodb-kubernetes-readinessprobe:1.0.22"
556             - name: MDB_COMMUNITY_IMAGE
557               value: "mongodb-community-server"
558             - name: MDB_COMMUNITY_REPO_URL
559               value: "quay.io/mongodb"
560             - name: MDB_COMMUNITY_IMAGE_TYPE
561               value: "ubi8"
562             # Community Env Vars End
563             - name: MDB_SEARCH_REPO_URL
564               value: "quay.io/mongodb"
565             - name: MDB_SEARCH_NAME
566               value: "mongodb-search"
567             - name: MDB_SEARCH_VERSION
568               value: "0.53.1"

前面的命令会在 mongodb命名空间中安装Kubernetes Operator；如果该命名空间不存在，则会创建该命名空间。安装后， Kubernetes Operator 会监视 MongoDBSearch 自定义资源并管理MongoDB Search 和 Vector Search 部署的生命周期。

安装MongoDB Search 和 Vector Search

必需。创建并加载MongoDB用户密钥。

mongot进程需要身份验证凭证才能连接到外部MongoDB 部署，从而创建搜索索引和运行搜索查询。此步骤将创建以下Kubernetes密钥：

mdb-admin-user-password — MongoDB管理员的凭证。
mdb-user-password — 经授权执行搜索查询的用户的凭证。
mdbc-rs-search-sync-source-password — 专用搜索用户的凭证，由 mongot进程在内部用于同步数据和管理索引。

Kubernetes Operator 将这些密钥挂载到MongoDB Pod 中。

要创建密钥，请在计划部署MongoDB Search 和 Vector Search 的命名空间中复制、粘贴并运行以下命令：

1 kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
2   create secret generic mdb-admin-user-password \
3   --from-literal=password="${MDB_ADMIN_USER_PASSWORD}"
4 
5 kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
6   create secret generic mdbc-rs-search-sync-source-password \
7   --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}"
8 
9 kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
10   create secret generic mdb-user-password \
11   --from-literal=password="${MDB_USER_PASSWORD}"

1 secret/mdb-admin-user-password created
2 secret/mdbc-rs-search-sync-source-password created
3 secret/mdb-user-password created

必需。部署密钥文件密钥以用于连接到 `mongod`。

为了对来自外部MongoDB 的连接进行身份验证，mongot进程使用的密钥文件与外部MongoDB副本集用于副本集之间的内部身份验证的密钥文件相同。

要创建包含来自外部MongoDB 的密钥文件内容的Kubernetes密钥，请复制、粘贴并运行以下命令：

1 kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
2   create secret generic "${MDB_EXTERNAL_KEYFILE_SECRET_NAME}" \
3   --from-literal=keyfile="${MDB_EXTERNAL_KEYFILE_CONTENT}"

必需。为MongoDB Search 和 Vector Search 创建并部署资源。

您可以部署一个搜索节点实例，而无需任何负载均衡。要部署，请完成以下步骤：

创建名为 mdbs 的 MongoDBSearch 自定义资源。

此资源包含以下内容：

`spec.source.external.hostAndPorts`	外部MongoDB副本集节点列表。
`spec.source.external.keyfileSecretRef`	外部副本集成员使用的密钥文件密钥。
`spec.source.username`	搜索同步用户用户名。
`spec.source.passwordSecretRef`	搜索同步用户密码。
`spec.resourceRequirements`	搜索容器的 CPU 和内存资源要求。

要学习；了解有关此自定义资源中设置的更多信息，请参阅MongoDB搜索和向量搜索设置。

1 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
2 apiVersion: mongodb.com/v1
3 kind: MongoDBSearch
4 metadata:
5   name: mdbs
6 spec:
7   source:
8     external:
9       hostAndPorts:
10         - ${MDB_EXTERNAL_HOST_0}
11         - ${MDB_EXTERNAL_HOST_1}
12         - ${MDB_EXTERNAL_HOST_2}
13       keyfileSecretRef:
14         name: ${MDB_EXTERNAL_KEYFILE_SECRET_NAME}
15         key: keyfile
16     username: search-sync-source
17     passwordSecretRef:
18       name: mdbc-rs-search-sync-source-password
19       key: password
20   resourceRequirements:
21     limits:
22       cpu: "3"
23       memory: 5Gi
24     requests:
25       cpu: "2"
26       memory: 3Gi
27 EOF

等待 MongoDBSearch资源部署完成。
当您应用MongoDBSearch 自定义资源时， Kubernetes 操作符开始部署搜索节点 (pod)。此步骤会暂停执行，直到 mdbs 资源的状态阶段为 Running，这表示MongoDB Search StatefulSet 处于可操作状态。
```
1 echo "Waiting for MongoDBSearch resource to reach Running phase..."
2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
3   --for=jsonpath='{.status.phase}'=Running mdbs/mdbs --timeout=300s
```

必需。为MongoDB Search 和 Vector Search 配置外部访问权限。

启用外部MongoDB实例能够连接到搜索服务，您必须为MongoDB Search 和 Vector Search 配置外部访问权限。您可以创建一个 LoadBalancer 服务，在Kubernetes集群外部公开搜索Pod。

以下服务使用可从Kubernetes集群外部访问的外部IP解决或主机名公开端口 27027 上的 MongoDBSearch 服务。

1 kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<YAML
2 apiVersion: v1
3 kind: Service
4 metadata:
5   name: ${MDB_SEARCH_HOSTNAME}
6 spec:
7   type: LoadBalancer
8   selector:
9     app: mdbs-search-svc
10   ports:
11     - name: mongot
12       port: 27027
13       targetPort: 27027
14 YAML
15 
16 echo "Waiting for external IP to be assigned to service ${MDB_SEARCH_HOSTNAME}..."
17 TIMEOUT=120  # 2 minutes timeout
18 ELAPSED=0
19 while [ ${ELAPSED} -lt ${TIMEOUT} ]; do
20   EXTERNAL_IP=$(kubectl get service "${MDB_SEARCH_HOSTNAME}" --context "${K8S_CTX}" -n "${MDB_NS}" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null)
21   if [ -n "${EXTERNAL_IP}" ] && [ "${EXTERNAL_IP}" != "null" ]; then
22     echo "External IP assigned: ${EXTERNAL_IP}"
23     break
24   fi
25   echo "Still waiting for external IP assignment... (${ELAPSED}s/${TIMEOUT}s)"
26   sleep 5
27   ELAPSED=$((ELAPSED + 5))
28 done
29 
30 if [ ${ELAPSED} -ge ${TIMEOUT} ]; then
31   echo "ERROR: Timeout reached (${TIMEOUT}s) while waiting for external IP assignment"
32   echo "LoadBalancer service may take longer to provision or there may be an issue"
33   exit 1
34 fi

可选。查看命名空间中所有运行的Pod。

查看MongoDB副本集成员、 Kubernetes Operator 的MongoDB控制器以及搜索节点的命名空间Pod 中运行的所有 Pod。

1 echo; echo "MongoDBSearch resource"
2 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbs/mdbs
3 echo; echo "Search pods running in cluster ${K8S_CTX}"
4 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods -l app=mdbs-search-svc
5 echo; echo "All pods in namespace ${MDB_NS}"
6 kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods

1 MongoDBSearch resource
2 NAME   PHASE     AGE
3 mdbs   Running   31s
4 
5 Search pods running in cluster kind-kind
6 NAME            READY   STATUS    RESTARTS   AGE
7 mdbs-search-0   1/1     Running   0          31s
8 
9 All pods in namespace mongodb
10 NAME                                          READY   STATUS    RESTARTS   AGE
11 mdbc-rs-0                                     2/2     Running   0          2m55s
12 mdbc-rs-1                                     2/2     Running   0          115s
13 mdbc-rs-2                                     2/2     Running   0          68s
14 mdbs-search-0                                 1/1     Running   0          31s
15 mongodb-kubernetes-operator-fc996f567-q8l6g   1/1     Running   0          2m58s

后续步骤

现在，您已成功部署MongoDB Search 和 Vector Search 以与外部MongoDB Enterprise Edition 一起使用，您可以将数据添加到MongoDB 集群，创建MongoDB Search 和 Vector Search 索引，并对数据运行查询。要学习；了解更多信息，请参阅MongoDB搜索和向量搜索设置。

1	export K8S_CTX="<your kubernetes context here>"
2
3	export MDB_NS="mongodb"
4
5	export MDB_VERSION="8.0.10"
6
7	export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
8	export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
9	export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
10
11	export MDB_SEARCH_HOSTNAME="mdbs-search"
12
13	# External MongoDB replica set members - REPLACE THESE VALUES with your actual external MongoDB hosts
14	# In production, replace with your actual external MongoDB replica set members
15	export MDB_EXTERNAL_HOST_0="mdbc-rs-0.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
16	export MDB_EXTERNAL_HOST_1="mdbc-rs-1.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
17	export MDB_EXTERNAL_HOST_2="mdbc-rs-2.mdbc-rs-svc.${MDB_NS}.svc.cluster.local:27017"
18
19	# REPLACE with your external MongoDB keyfile secret name
20	export MDB_EXTERNAL_KEYFILE_SECRET_NAME="mdbc-rs-keyfile"
21
22	# REPLACE with the actual keyfile content from your external MongoDB replica set
23	# For testing, this will be automatically generated by the MongoDB Community resource
24	export MDB_EXTERNAL_KEYFILE_CONTENT="your-mongodb-keyfile-content-CHANGE-ME"
25
26	# REPLACE with your actual external MongoDB replica set name
27	export MDB_EXTERNAL_REPLICA_SET_NAME="mdbc-rs"
28
29	export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes"
30	export OPERATOR_ADDITIONAL_HELM_VALUES=""
31
32	export MDB_CONNECTION_STRING="mongodb://mdb-user:${MDB_USER_PASSWORD}@${MDB_EXTERNAL_HOST_0}/?replicaSet=${MDB_EXTERNAL_REPLICA_SET_NAME}"

1	helm repo add mongodb https://mongodb.github.io/helm-charts
2	helm repo update mongodb
3	helm search repo mongodb/mongodb-kubernetes

1	"mongodb" already exists with the same configuration, skipping
2	Hang tight while we grab the latest from your chart repositories...
3	...Successfully got an update from the "mongodb" chart repository
4	Update Complete. ⎈Happy Helming!⎈
5	NAME CHART VERSION APP VERSION DESCRIPTION
6	mongodb/mongodb-kubernetes 1.3.0 MongoDB Controllers for Kubernetes translate th...

1	helm upgrade --install --debug --kube-context "${K8S_CTX}" \
2	--create-namespace \
3	--namespace="${MDB_NS}" \
4	mongodb-kubernetes \
5	${OPERATOR_ADDITIONAL_HELM_VALUES:+--set ${OPERATOR_ADDITIONAL_HELM_VALUES}} \
6	"${OPERATOR_HELM_CHART}"

1	Release "mongodb-kubernetes" does not exist. Installing it now.
2	NAME: mongodb-kubernetes
3	LAST DEPLOYED: Tue Sep 16 14:11:48 2025
4	NAMESPACE: mongodb
5	STATUS: deployed
6	REVISION: 1
7	TEST SUITE: None
8	USER-SUPPLIED VALUES:
9	{}
10
11	COMPUTED VALUES:
12	agent:
13	name: mongodb-agent
14	version: 108.0.12.8846-1
15	community:
16	agent:
17	name: mongodb-agent
18	version: 108.0.2.8729-1
19	mongodb:
20	imageType: ubi8
21	name: mongodb-community-server
22	repo: quay.io/mongodb
23	registry:
24	agent: quay.io/mongodb
25	resource:
26	members: 3
27	name: mongodb-replica-set
28	tls:
29	caCertificateSecretRef: tls-ca-key-pair
30	certManager:
31	certDuration: 8760h
32	renewCertBefore: 720h
33	certificateKeySecretRef: tls-certificate
34	enabled: false
35	sampleX509User: false
36	useCertManager: true
37	useX509: false
38	version: 4.4.0
39	database:
40	name: mongodb-kubernetes-database
41	version: 1.4.0
42	initAppDb:
43	name: mongodb-kubernetes-init-appdb
44	version: 1.4.0
45	initDatabase:
46	name: mongodb-kubernetes-init-database
47	version: 1.4.0
48	initOpsManager:
49	name: mongodb-kubernetes-init-ops-manager
50	version: 1.4.0
51	managedSecurityContext: false
52	mongodb:
53	appdbAssumeOldFormat: false
54	imageType: ubi8
55	name: mongodb-enterprise-server
56	repo: quay.io/mongodb
57	multiCluster:
58	clusterClientTimeout: 10
59	clusters: []
60	kubeConfigSecretName: mongodb-enterprise-operator-multi-cluster-kubeconfig
61	performFailOver: true
62	operator:
63	additionalArguments: []
64	affinity: {}
65	baseName: mongodb-kubernetes
66	createOperatorServiceAccount: true
67	createResourcesServiceAccountsAndRoles: true
68	deployment_name: mongodb-kubernetes-operator
69	enableClusterMongoDBRoles: true
70	enablePVCResize: true
71	env: prod
72	maxConcurrentReconciles: 1
73	mdbDefaultArchitecture: non-static
74	name: mongodb-kubernetes-operator
75	nodeSelector: {}
76	operator_image_name: mongodb-kubernetes
77	replicas: 1
78	resources:
79	limits:
80	cpu: 1100m
81	memory: 1Gi
82	requests:
83	cpu: 500m
84	memory: 200Mi
85	telemetry:
86	collection:
87	clusters: {}
88	deployments: {}
89	frequency: 1h
90	operators: {}
91	send:
92	frequency: 168h
93	tolerations: []
94	vaultSecretBackend:
95	enabled: false
96	tlsSecretRef: ""
97	version: 1.4.0
98	watchedResources:
99	- mongodb
100	- opsmanagers
101	- mongodbusers
102	- mongodbcommunity
103	- mongodbsearch
104	webhook:
105	installClusterRole: true
106	registerConfiguration: true
107	opsManager:
108	name: mongodb-enterprise-ops-manager-ubi
109	readinessProbe:
110	name: mongodb-kubernetes-readinessprobe
111	version: 1.0.22
112	registry:
113	agent: quay.io/mongodb
114	database: quay.io/mongodb
115	imagePullSecrets: null
116	initAppDb: quay.io/mongodb
117	initDatabase: quay.io/mongodb
118	initOpsManager: quay.io/mongodb
119	operator: quay.io/mongodb
120	opsManager: quay.io/mongodb
121	pullPolicy: Always
122	readinessProbe: quay.io/mongodb
123	versionUpgradeHook: quay.io/mongodb
124	search:
125	name: mongodb-search
126	repo: quay.io/mongodb
127	version: 0.53.1
128	versionUpgradeHook:
129	name: mongodb-kubernetes-operator-version-upgrade-post-start-hook
130	version: 1.0.9
131
132	HOOKS:
133	MANIFEST:
134	---
135	# Source: mongodb-kubernetes/templates/database-roles.yaml
136	apiVersion: v1
137	kind: ServiceAccount
138	metadata:
139	name: mongodb-kubernetes-appdb
140	namespace: mongodb
141	---
142	# Source: mongodb-kubernetes/templates/database-roles.yaml
143	apiVersion: v1
144	kind: ServiceAccount
145	metadata:
146	name: mongodb-kubernetes-database-pods
147	namespace: mongodb
148	---
149	# Source: mongodb-kubernetes/templates/database-roles.yaml
150	apiVersion: v1
151	kind: ServiceAccount
152	metadata:
153	name: mongodb-kubernetes-ops-manager
154	namespace: mongodb
155	---
156	# Source: mongodb-kubernetes/templates/operator-sa.yaml
157	apiVersion: v1
158	kind: ServiceAccount
159	metadata:
160	name: mongodb-kubernetes-operator
161	namespace: mongodb
162	---
163	# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
164	kind: ClusterRole
165	apiVersion: rbac.authorization.k8s.io/v1
166	metadata:
167	name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
168	rules:
169	- apiGroups:
170	- mongodb.com
171	verbs:
172	- '*'
173	resources:
174	- clustermongodbroles
175	---
176	# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
177	# Additional ClusterRole for clusterVersionDetection
178	kind: ClusterRole
179	apiVersion: rbac.authorization.k8s.io/v1
180	metadata:
181	name: mongodb-kubernetes-operator-cluster-telemetry
182	rules:
183	# Non-resource URL permissions
184	- nonResourceURLs:
185	- "/version"
186	verbs:
187	- get
188	# Cluster-scoped resource permissions
189	- apiGroups:
190	- ''
191	resources:
192	- namespaces
193	resourceNames:
194	- kube-system
195	verbs:
196	- get
197	- apiGroups:
198	- ''
199	resources:
200	- nodes
201	verbs:
202	- list
203	---
204	# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
205	kind: ClusterRole
206	apiVersion: rbac.authorization.k8s.io/v1
207	metadata:
208	name: mongodb-kubernetes-operator-mongodb-webhook-cr
209	rules:
210	- apiGroups:
211	- "admissionregistration.k8s.io"
212	resources:
213	- validatingwebhookconfigurations
214	verbs:
215	- get
216	- create
217	- update
218	- delete
219	- apiGroups:
220	- ""
221	resources:
222	- services
223	verbs:
224	- get
225	- list
226	- watch
227	- create
228	- update
229	- delete
230	---
231	# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
232	kind: ClusterRoleBinding
233	apiVersion: rbac.authorization.k8s.io/v1
234	metadata:
235	name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
236	roleRef:
237	apiGroup: rbac.authorization.k8s.io
238	kind: ClusterRole
239	name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
240	subjects:
241	- kind: ServiceAccount
242	name: mongodb-kubernetes-operator
243	namespace: mongodb
244	---
245	# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
246	# ClusterRoleBinding for clusterVersionDetection
247	kind: ClusterRoleBinding
248	apiVersion: rbac.authorization.k8s.io/v1
249	metadata:
250	name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
251	roleRef:
252	apiGroup: rbac.authorization.k8s.io
253	kind: ClusterRole
254	name: mongodb-kubernetes-operator-cluster-telemetry
255	subjects:
256	- kind: ServiceAccount
257	name: mongodb-kubernetes-operator
258	namespace: mongodb
259	---
260	# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
261	kind: ClusterRoleBinding
262	apiVersion: rbac.authorization.k8s.io/v1
263	metadata:
264	name: mongodb-kubernetes-operator-mongodb-webhook-crb
265	roleRef:
266	apiGroup: rbac.authorization.k8s.io
267	kind: ClusterRole
268	name: mongodb-kubernetes-operator-mongodb-webhook-cr
269	subjects:
270	- kind: ServiceAccount
271	name: mongodb-kubernetes-operator
272	namespace: mongodb
273	---
274	# Source: mongodb-kubernetes/templates/database-roles.yaml
275	kind: Role
276	apiVersion: rbac.authorization.k8s.io/v1
277	metadata:
278	name: mongodb-kubernetes-appdb
279	namespace: mongodb
280	rules:
281	- apiGroups:
282	- ''
283	resources:
284	- secrets
285	verbs:
286	- get
287	- apiGroups:
288	- ''
289	resources:
290	- pods
291	verbs:
292	- patch
293	- delete
294	- get
295	---
296	# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
297	kind: Role
298	apiVersion: rbac.authorization.k8s.io/v1
299	metadata:
300	name: mongodb-kubernetes-operator
301	namespace: mongodb
302	rules:
303	- apiGroups:
304	- ''
305	resources:
306	- services
307	verbs:
308	- get
309	- list
310	- watch
311	- create
312	- update
313	- delete
314	- apiGroups:
315	- ''
316	resources:
317	- secrets
318	- configmaps
319	verbs:
320	- get
321	- list
322	- create
323	- update
324	- delete
325	- watch
326	- apiGroups:
327	- apps
328	resources:
329	- statefulsets
330	verbs:
331	- create
332	- get
333	- list
334	- watch
335	- delete
336	- update
337	- apiGroups:
338	- ''
339	resources:
340	- pods
341	verbs:
342	- get
343	- list
344	- watch
345	- delete
346	- deletecollection
347	- apiGroups:
348	- mongodbcommunity.mongodb.com
349	resources:
350	- mongodbcommunity
351	- mongodbcommunity/status
352	- mongodbcommunity/spec
353	- mongodbcommunity/finalizers
354	verbs:
355	- '*'
356	- apiGroups:
357	- mongodb.com
358	verbs:
359	- '*'
360	resources:
361	- mongodb
362	- mongodb/finalizers
363	- mongodbusers
364	- mongodbusers/finalizers
365	- opsmanagers
366	- opsmanagers/finalizers
367	- mongodbmulticluster
368	- mongodbmulticluster/finalizers
369	- mongodbsearch
370	- mongodbsearch/finalizers
371	- mongodb/status
372	- mongodbusers/status
373	- opsmanagers/status
374	- mongodbmulticluster/status
375	- mongodbsearch/status
376	---
377	# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
378	kind: Role
379	apiVersion: rbac.authorization.k8s.io/v1
380	metadata:
381	name: mongodb-kubernetes-operator-pvc-resize
382	namespace: mongodb
383	rules:
384	- apiGroups:
385	- ''
386	resources:
387	- persistentvolumeclaims
388	verbs:
389	- get
390	- delete
391	- list
392	- watch
393	- patch
394	- update
395	---
396	# Source: mongodb-kubernetes/templates/database-roles.yaml
397	kind: RoleBinding
398	apiVersion: rbac.authorization.k8s.io/v1
399	metadata:
400	name: mongodb-kubernetes-appdb
401	namespace: mongodb
402	roleRef:
403	apiGroup: rbac.authorization.k8s.io
404	kind: Role
405	name: mongodb-kubernetes-appdb
406	subjects:
407	- kind: ServiceAccount
408	name: mongodb-kubernetes-appdb
409	namespace: mongodb
410	---
411	# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
412	kind: RoleBinding
413	apiVersion: rbac.authorization.k8s.io/v1
414	metadata:
415	name: mongodb-kubernetes-operator
416	namespace: mongodb
417	roleRef:
418	apiGroup: rbac.authorization.k8s.io
419	kind: Role
420	name: mongodb-kubernetes-operator
421	subjects:
422	- kind: ServiceAccount
423	name: mongodb-kubernetes-operator
424	namespace: mongodb
425	---
426	# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
427	kind: RoleBinding
428	apiVersion: rbac.authorization.k8s.io/v1
429	metadata:
430	name: mongodb-kubernetes-operator-pvc-resize-binding
431	namespace: mongodb
432	roleRef:
433	apiGroup: rbac.authorization.k8s.io
434	kind: Role
435	name: mongodb-kubernetes-operator-pvc-resize
436	subjects:
437	- kind: ServiceAccount
438	name: mongodb-kubernetes-operator
439	namespace: mongodb
440	---
441	# Source: mongodb-kubernetes/templates/operator.yaml
442	apiVersion: apps/v1
443	kind: Deployment
444	metadata:
445	name: mongodb-kubernetes-operator
446	namespace: mongodb
447	spec:
448	replicas: 1
449	selector:
450	matchLabels:
451	app.kubernetes.io/component: controller
452	app.kubernetes.io/name: mongodb-kubernetes-operator
453	app.kubernetes.io/instance: mongodb-kubernetes-operator
454	template:
455	metadata:
456	labels:
457	app.kubernetes.io/component: controller
458	app.kubernetes.io/name: mongodb-kubernetes-operator
459	app.kubernetes.io/instance: mongodb-kubernetes-operator
460	spec:
461	serviceAccountName: mongodb-kubernetes-operator
462	securityContext:
463	runAsNonRoot: true
464	runAsUser: 2000
465	containers:
466	- name: mongodb-kubernetes-operator
467	image: "quay.io/mongodb/mongodb-kubernetes:1.4.0"
468	imagePullPolicy: Always
469	args:
470	- -watch-resource=mongodb
471	- -watch-resource=opsmanagers
472	- -watch-resource=mongodbusers
473	- -watch-resource=mongodbcommunity
474	- -watch-resource=mongodbsearch
475	- -watch-resource=clustermongodbroles
476	command:
477	- /usr/local/bin/mongodb-kubernetes-operator
478	resources:
479	limits:
480	cpu: 1100m
481	memory: 1Gi
482	requests:
483	cpu: 500m
484	memory: 200Mi
485	env:
486	- name: OPERATOR_ENV
487	value: prod
488	- name: MDB_DEFAULT_ARCHITECTURE
489	value: non-static
490	- name: NAMESPACE
491	valueFrom:
492	fieldRef:
493	fieldPath: metadata.namespace
494	- name: WATCH_NAMESPACE
495	valueFrom:
496	fieldRef:
497	fieldPath: metadata.namespace
498	- name: MDB_OPERATOR_TELEMETRY_COLLECTION_FREQUENCY
499	value: "1h"
500	- name: MDB_OPERATOR_TELEMETRY_SEND_FREQUENCY
501	value: "168h"
502	- name: CLUSTER_CLIENT_TIMEOUT
503	value: "10"
504	- name: IMAGE_PULL_POLICY
505	value: Always
506	# Database
507	- name: MONGODB_ENTERPRISE_DATABASE_IMAGE
508	value: quay.io/mongodb/mongodb-kubernetes-database
509	- name: INIT_DATABASE_IMAGE_REPOSITORY
510	value: quay.io/mongodb/mongodb-kubernetes-init-database
511	- name: INIT_DATABASE_VERSION
512	value: 1.4.0
513	- name: DATABASE_VERSION
514	value: 1.4.0
515	# Ops Manager
516	- name: OPS_MANAGER_IMAGE_REPOSITORY
517	value: quay.io/mongodb/mongodb-enterprise-ops-manager-ubi
518	- name: INIT_OPS_MANAGER_IMAGE_REPOSITORY
519	value: quay.io/mongodb/mongodb-kubernetes-init-ops-manager
520	- name: INIT_OPS_MANAGER_VERSION
521	value: 1.4.0
522	# AppDB
523	- name: INIT_APPDB_IMAGE_REPOSITORY
524	value: quay.io/mongodb/mongodb-kubernetes-init-appdb
525	- name: INIT_APPDB_VERSION
526	value: 1.4.0
527	- name: OPS_MANAGER_IMAGE_PULL_POLICY
528	value: Always
529	- name: AGENT_IMAGE
530	value: "quay.io/mongodb/mongodb-agent:108.0.12.8846-1"
531	- name: MDB_AGENT_IMAGE_REPOSITORY
532	value: "quay.io/mongodb/mongodb-agent"
533	- name: MONGODB_IMAGE
534	value: mongodb-enterprise-server
535	- name: MONGODB_REPO_URL
536	value: quay.io/mongodb
537	- name: MDB_IMAGE_TYPE
538	value: ubi8
539	- name: PERFORM_FAILOVER
540	value: 'true'
541	- name: MDB_MAX_CONCURRENT_RECONCILES
542	value: "1"
543	- name: POD_NAME
544	valueFrom:
545	fieldRef:
546	fieldPath: metadata.name
547	- name: OPERATOR_NAME
548	value: mongodb-kubernetes-operator
549	# Community Env Vars Start
550	- name: MDB_COMMUNITY_AGENT_IMAGE
551	value: "quay.io/mongodb/mongodb-agent:108.0.2.8729-1"
552	- name: VERSION_UPGRADE_HOOK_IMAGE
553	value: "quay.io/mongodb/mongodb-kubernetes-operator-version-upgrade-post-start-hook:1.0.9"
554	- name: READINESS_PROBE_IMAGE
555	value: "quay.io/mongodb/mongodb-kubernetes-readinessprobe:1.0.22"
556	- name: MDB_COMMUNITY_IMAGE
557	value: "mongodb-community-server"
558	- name: MDB_COMMUNITY_REPO_URL
559	value: "quay.io/mongodb"
560	- name: MDB_COMMUNITY_IMAGE_TYPE
561	value: "ubi8"
562	# Community Env Vars End
563	- name: MDB_SEARCH_REPO_URL
564	value: "quay.io/mongodb"
565	- name: MDB_SEARCH_NAME
566	value: "mongodb-search"
567	- name: MDB_SEARCH_VERSION
568	value: "0.53.1"

1	kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
2	create secret generic mdb-admin-user-password \
3	--from-literal=password="${MDB_ADMIN_USER_PASSWORD}"
4
5	kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
6	create secret generic mdbc-rs-search-sync-source-password \
7	--from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}"
8
9	kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
10	create secret generic mdb-user-password \
11	--from-literal=password="${MDB_USER_PASSWORD}"

1	secret/mdb-admin-user-password created
2	secret/mdbc-rs-search-sync-source-password created
3	secret/mdb-user-password created

1	kubectl --context "${K8S_CTX}" --namespace "${MDB_NS}" \
2	create secret generic "${MDB_EXTERNAL_KEYFILE_SECRET_NAME}" \
3	--from-literal=keyfile="${MDB_EXTERNAL_KEYFILE_CONTENT}"

1	kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<EOF
2	apiVersion: mongodb.com/v1
3	kind: MongoDBSearch
4	metadata:
5	name: mdbs
6	spec:
7	source:
8	external:
9	hostAndPorts:
10	- ${MDB_EXTERNAL_HOST_0}
11	- ${MDB_EXTERNAL_HOST_1}
12	- ${MDB_EXTERNAL_HOST_2}
13	keyfileSecretRef:
14	name: ${MDB_EXTERNAL_KEYFILE_SECRET_NAME}
15	key: keyfile
16	username: search-sync-source
17	passwordSecretRef:
18	name: mdbc-rs-search-sync-source-password
19	key: password
20	resourceRequirements:
21	limits:
22	cpu: "3"
23	memory: 5Gi
24	requests:
25	cpu: "2"
26	memory: 3Gi
27	EOF

1	echo "Waiting for MongoDBSearch resource to reach Running phase..."
2	kubectl --context "${K8S_CTX}" -n "${MDB_NS}" wait \
3	--for=jsonpath='{.status.phase}'=Running mdbs/mdbs --timeout=300s

1	kubectl apply --context "${K8S_CTX}" -n "${MDB_NS}" -f - <<YAML
2	apiVersion: v1
3	kind: Service
4	metadata:
5	name: ${MDB_SEARCH_HOSTNAME}
6	spec:
7	type: LoadBalancer
8	selector:
9	app: mdbs-search-svc
10	ports:
11	- name: mongot
12	port: 27027
13	targetPort: 27027
14	YAML
15
16	echo "Waiting for external IP to be assigned to service ${MDB_SEARCH_HOSTNAME}..."
17	TIMEOUT=120 # 2 minutes timeout
18	ELAPSED=0
19	while [ ${ELAPSED} -lt ${TIMEOUT} ]; do
20	EXTERNAL_IP=$(kubectl get service "${MDB_SEARCH_HOSTNAME}" --context "${K8S_CTX}" -n "${MDB_NS}" -o jsonpath='{.status.loadBalancer.ingress[0].ip}' 2>/dev/null)
21	if [ -n "${EXTERNAL_IP}" ] && [ "${EXTERNAL_IP}" != "null" ]; then
22	echo "External IP assigned: ${EXTERNAL_IP}"
23	break
24	fi
25	echo "Still waiting for external IP assignment... (${ELAPSED}s/${TIMEOUT}s)"
26	sleep 5
27	ELAPSED=$((ELAPSED + 5))
28	done
29
30	if [ ${ELAPSED} -ge ${TIMEOUT} ]; then
31	echo "ERROR: Timeout reached (${TIMEOUT}s) while waiting for external IP assignment"
32	echo "LoadBalancer service may take longer to provision or there may be an issue"
33	exit 1
34	fi

1	echo; echo "MongoDBSearch resource"
2	kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get mdbs/mdbs
3	echo; echo "Search pods running in cluster ${K8S_CTX}"
4	kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods -l app=mdbs-search-svc
5	echo; echo "All pods in namespace ${MDB_NS}"
6	kubectl --context "${K8S_CTX}" -n "${MDB_NS}" get pods

1	MongoDBSearch resource
2	NAME PHASE AGE
3	mdbs Running 31s
4
5	Search pods running in cluster kind-kind
6	NAME READY STATUS RESTARTS AGE
7	mdbs-search-0 1/1 Running 0 31s
8
9	All pods in namespace mongodb
10	NAME READY STATUS RESTARTS AGE
11	mdbc-rs-0 2/2 Running 0 2m55s
12	mdbc-rs-1 2/2 Running 0 115s
13	mdbc-rs-2 2/2 Running 0 68s
14	mdbs-search-0 1/1 Running 0 31s
15	mongodb-kubernetes-operator-fc996f567-q8l6g 1/1 Running 0 2m58s

先决条件

开始之前

为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager参数

GoCloud Manager或MongoDB Ops Manager .leafygreen-ui-8n27nz{font-style:normal;font-weight:700;}Deployment 页面。

修改Cloud Manager或MongoDB Ops Manager部署配置。

查看并部署更改。

为MongoDB Search 和 Vector Search 配置Cloud Manager或MongoDB Ops Manager用户

MongoDB 8.2 或更高版本

转到 Users（快速入门）页面。

单击 Add New User（保存并关闭）。

为用户设置凭证。

将searchCoordinator 角色分配给用户。

Add User单击 创建具有searchCoordinator 角色的用户。

切换到 admin 数据库。

将密码替换为安全密码后，运行以下命令以创建用户。

8.2 之前的MongoDB版本

转到 Roles（快速入门）页面。

将 Role Name 设置为 searchCoordinator。

指定要继承的角色。

添加要分配给该角色的数据库权限。

配置集群权限。

查看所有设置并单击Create Role 。

转到 Users（快速入门）页面。

单击 Add New User（保存并关闭）。

为用户设置凭证。

将searchCoordinator 角色分配给用户。

切换到 admin 数据库。

创建自定义角色。

将密码替换为安全密码后，运行以下命令以创建用户。

设置您的环境

必填。设置环境变量。

有条件。添加MongoDB Helm存储库。

有条件。为Kubernetes Operator 安装MongoDB控制器。

安装MongoDB Search 和 Vector Search

必需。创建并加载MongoDB用户密钥。

必需。部署密钥文件密钥以用于连接到 mongod。

必需。为MongoDB Search 和 Vector Search 创建并部署资源。

必需。为MongoDB Search 和 Vector Search 配置外部访问权限。

可选。查看命名空间中所有运行的Pod。

后续步骤

GoCloud Manager或MongoDB Ops Manager Deployment 页面。

将`searchCoordinator` 角色分配给用户。

Add User单击创建具有`searchCoordinator` 角色的用户。

切换到 `admin` 数据库。

将 Role Name 设置为 `searchCoordinator`。

将`searchCoordinator` 角色分配给用户。

切换到 `admin` 数据库。

必需。部署密钥文件密钥以用于连接到 `mongod`。