For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.

Multi-Cluster ReplicaSets Without a Service Mesh

Multi-Kubernetes cluster MongoDB deployments allow you to add MongoDB instances in global clusters that span multiple geographic regions for increased availability and global distribution of data.

Prerequisites

Before you begin the following procedure, perform the following actions:

# This script builds on top of the environment configured in the setup guides.# It depends (uses) the following env variables defined there to work correctly.# If you don't use the setup guide to bootstrap the environment, then define them here.#  ${K8S_CLUSTER_0_CONTEXT_NAME}#  ${K8S_CLUSTER_1_CONTEXT_NAME}#  ${K8S_CLUSTER_2_CONTEXT_NAME}#  ${MDB_NAMESPACE}#  ${CUSTOM_DOMAIN}
export RS_RESOURCE_NAME=mdbexport MONGODB_VERSION="8.0.5-ent"
export MDB_CLUSTER_0_EXTERNAL_DOMAIN="${K8S_CLUSTER_0}.${CUSTOM_DOMAIN}"export MDB_CLUSTER_1_EXTERNAL_DOMAIN="${K8S_CLUSTER_1}.${CUSTOM_DOMAIN}"export MDB_CLUSTER_2_EXTERNAL_DOMAIN="${K8S_CLUSTER_2}.${CUSTOM_DOMAIN}"

Source Code

You can find all included source code in the MongoDB Kubernetes Operator repository.

Procedure

1

Create a CA certificate.

Run the following script to create the required CA Certificate with your certificate issuer.

kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata:  name: mdb-certspec:  dnsNames:  - "*.${MDB_CLUSTER_0_EXTERNAL_DOMAIN}"  - "*.${MDB_CLUSTER_1_EXTERNAL_DOMAIN}"  - "*.${MDB_CLUSTER_2_EXTERNAL_DOMAIN}"  duration: 240h0m0s  issuerRef:    name: my-ca-issuer    kind: ClusterIssuer  renewBefore: 120h0m0s  secretName: cert-prefix-mdb-cert  usages:  - server auth  - client authEOF
2

Deploy the MongoDBMultiCluster resource.

Set spec.credentials, spec.opsManager.configMapRef.name, which you defined in the Multi-Cluster Ops Manager Without a Service Mesh procedure; define your security settings and deploy the MongoDBMultiCluster resource.

kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOFapiVersion: mongodb.com/v1kind: MongoDBMultiClustermetadata:  name: ${RS_RESOURCE_NAME}spec:  type: ReplicaSet  version: ${MONGODB_VERSION}  opsManager:    configMapRef:      name: mdb-org-project-config  credentials: mdb-org-owner-credentials  duplicateServiceObjects: false  persistent: true  backup:    mode: enabled  security:    certsSecretPrefix: cert-prefix    tls:      ca: ca-issuer    authentication:      enabled: true      modes: ["SCRAM"]  clusterSpecList:    - clusterName: ${K8S_CLUSTER_0_CONTEXT_NAME}      members: 2      externalAccess:        externalDomain: "${MDB_CLUSTER_0_EXTERNAL_DOMAIN}"        externalService:          annotations:             external-dns.alpha.kubernetes.io/hostname: "{podName}.${MDB_CLUSTER_0_EXTERNAL_DOMAIN}"    - clusterName: ${K8S_CLUSTER_1_CONTEXT_NAME}      members: 1      externalAccess:        externalDomain: "${MDB_CLUSTER_1_EXTERNAL_DOMAIN}"        externalService:          annotations:             external-dns.alpha.kubernetes.io/hostname: "{podName}.${MDB_CLUSTER_1_EXTERNAL_DOMAIN}"    - clusterName: ${K8S_CLUSTER_2_CONTEXT_NAME}      members: 2      externalAccess:        externalDomain: "${MDB_CLUSTER_2_EXTERNAL_DOMAIN}"        externalService:          annotations:             external-dns.alpha.kubernetes.io/hostname: "{podName}.${MDB_CLUSTER_2_EXTERNAL_DOMAIN}"EOF
3

Verify that the MongoDBMultiCluster resource is running.

Run the following command to confirm that the MongoDBMultiCluster resource is running.

echo; echo "Waiting for MongoDB to reach Running phase..."kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" wait --for=jsonpath='{.status.phase}'=Running "mdbmc/${RS_RESOURCE_NAME}" --timeout=900secho; echo "Pods running in cluster ${K8S_CLUSTER_0_CONTEXT_NAME}"kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get podsecho; echo "Pods running in cluster ${K8S_CLUSTER_1_CONTEXT_NAME}"kubectl --context "${K8S_CLUSTER_1_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get podsecho; echo "Pods running in cluster ${K8S_CLUSTER_2_CONTEXT_NAME}"kubectl --context "${K8S_CLUSTER_2_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
4

Create a MongoDB user and password.

Run the following command to create a MongoDB user and password. Please use strong passwords for your deployments.

kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOFapiVersion: v1kind: Secretmetadata:  name: rs-user-passwordtype: OpaquestringData:  password: password---apiVersion: mongodb.com/v1kind: MongoDBUsermetadata:  name: rs-userspec:  passwordSecretKeyRef:    name: rs-user-password    key: password  username: "rs-user"  db: "admin"  mongodbResourceRef:    name: ${RS_RESOURCE_NAME}  roles:  - db: "admin"    name: "root"EOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=jsonpath='{.status.phase}'=Updated -n "${MDB_NAMESPACE}" mdbu/rs-user --timeout=300s
5

Verify connectivity.

Run the mongosh following command to ensure that you can access your running MongoDB instance.

external_ip="$(kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" svc "${RS_RESOURCE_NAME}-0-0-svc-external" -o=jsonpath="{.status.loadBalancer.ingress[0].ip}")"
mkdir -p certskubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" cm/ca-issuer -o=jsonpath='{.data.ca-pem}' > certs/ca.crt
for attempt in 1 2 3 4 5 6; do  if mongosh --host "${external_ip}" --username rs-user --password password --tls --tlsCAFile certs/ca.crt --tlsAllowInvalidHostnames --eval "db.runCommand({connectionStatus : 1})"; then    break  fi  if (( attempt < 6 )); then    echo "mongosh auth failed (attempt ${attempt}/6), retrying in 10s..." >&2    sleep 10  fidone
{  authInfo: {    authenticatedUsers: [ { user: 'rs-user', db: 'admin' } ],    authenticatedUserRoles: [ { role: 'root', db: 'admin' } ]  },  ok: 1,  '$clusterTime': {    clusterTime: Timestamp({ t: 1792487693, i: 9 }),    signature: {      hash: Binary.createFromBase64('exoTqpH9opaVCYVVqgG7i0T+q4I=', 0),      keyId: Long('7698676015622520837')    }  },  operationTime: Timestamp({ t: 1792487693, i: 9 })}
Back
Multi-Cluster Ops Manager
Next
Multi-Cluster Sharded Cluster
Rate this page

On this page