This section provides guidance on the creation of TLS certificates for each component of MongoDB, and the creation of Kubernetes Secrets in each of your Kubernetes clusters to mount the TLS certificates securely into the appropriate Kubernetes Pods.
The process outlined below utilizes Cert Manager for creating the TLS certificates. However, note that this is an opinionated guide, and CertManager is not supported by MongoDB. Moreover, CertManager is only one of many ways in which you can add TLS certificates to your Kubernetes clusters. Additionally, self-signed certificates may not be suitable for production deployments, depending on the security requirements of your organization. If you require publicly trusted certificates configure your Issuer accordingly or provide the TLS certificate directly. To learn more, see Set Up a cert-manager Integration.
Prerequisites
Before you begin, perform the following tasks:
Install
kubectl.Set the
K8S_CLUSTER_*_CONTEXT_NAMEenvironment variables as explained in the GKE Clusters guide.
Source Code
You can find all included source code in the MongoDB Kubernetes Operator repository.
Procedure
Use Helm to install cert-manager.
helm upgrade --install \ cert-manager jetstack/cert-manager \ --kube-context "${K8S_CLUSTER_0_CONTEXT_NAME}" \ --namespace cert-manager \ --create-namespace \ --set crds.enabled=trueRelease "cert-manager" does not exist. Installing it now.NAME: cert-managerLAST DEPLOYED: Tue Oct 20 08:52:33 2026NAMESPACE: cert-managerSTATUS: deployedREVISION: 1TEST SUITE: NoneNOTES:cert-manager v1.21.2 has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssueror Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
More information on the different types of issuers and how to configure themcan be found in our documentation:
https://cert-manager.io/docs/configuration/
For information on how to configure cert-manager to automatically provisionCertificates for Ingress resources, take a look at the `ingress-shim`documentation:
https://cert-manager.io/docs/usage/ingress/
For information on how to configure cert-manager to automatically provisionCertificates for Gateway API resources, take a look at the `gateway resource`documentation:
https://cert-manager.io/docs/usage/gateway/Create a certificate issuer.
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata: name: selfsigned-cluster-issuerspec: selfSigned: {}EOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer selfsigned-cluster-issuer
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: my-selfsigned-ca namespace: cert-managerspec: isCA: true commonName: my-selfsigned-ca secretName: root-secret privateKey: algorithm: ECDSA size: 256 issuerRef: name: selfsigned-cluster-issuer kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready -n cert-manager certificate my-selfsigned-ca
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata: name: my-ca-issuerspec: ca: secretName: root-secretEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer my-ca-issuerVerify creation of the issuer.
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata: name: test-selfsigned-cert namespace: cert-managerspec: dnsNames: - example.com secretName: test-selfsigned-cert-tls issuerRef: name: my-ca-issuer kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait -n cert-manager --for=condition=Ready certificate test-selfsigned-cert
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete -n cert-manager certificate test-selfsigned-certcertificate.cert-manager.io/test-selfsigned-cert createdcertificate.cert-manager.io/test-selfsigned-cert condition metcertificate.cert-manager.io "test-selfsigned-cert" deleted from cert-manager namespaceCreate CA configMap.
If your Ops Manager TLS certificate is signed by a custom CA, the CA certificate must also contain additional certificates that allows the agents to download MongoDB binaries from the Internet. To create the TLS certificate(s), create a ConfigMap to hold the CA certificate:
mkdir -p certs
openssl s_client -showcerts -verify 2 \-connect downloads.mongodb.com:443 -servername downloads.mongodb.com < /dev/null \| awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="certs/cert"a".crt"; print >out}'
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" get secret root-secret -n cert-manager -o jsonpath="{.data['ca\.crt']}" | base64 --decode > certs/ca.crtcat certs/ca.crt certs/cert2.crt certs/cert3.crt >> certs/mms-ca.crt
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${MDB_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crtkubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${OM_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crt