For AI agents: a documentation index is available at https://www.mongodb.com/docs/llms.txt — markdown versions of all pages are available by appending .md to any URL path.

Manage TLS Certificates (Multi-Cluster Arch)

This section provides guidance on the creation of TLS certificates for each component of MongoDB, and the creation of Kubernetes Secrets in each of your Kubernetes clusters to mount the TLS certificates securely into the appropriate Kubernetes Pods.

The process outlined below utilizes Cert Manager for creating the TLS certificates. However, please note that this is an opinionated guide, and CertManager is not supported by MongoDB. Moreover, CertManager is only one of many ways in which you can add TLS certificates to your Kubernetes clusters. Additionally, self-signed certificates may not be suitable for production deployments, depending on the security requirements of your organization. If you require publicly trusted certificates please configure your Issuer accordingly or provide the TLS certificate directly. To learn more, see Set Up a cert-manager Integration.

Prerequisites

Before you begin, perform the following tasks:

  • Install kubectl.

  • Install Helm.

  • Set the K8S_CLUSTER_*_CONTEXT_NAME environment variables as explained in the GKE Clusters guide.

Source Code

You can find all included source code in the MongoDB Kubernetes Operator repository.

Procedure

1

Add the Helm charts repo.

helm repo add jetstack https://charts.jetstack.io --force-update
2

Use Helm to install cert-manager.

helm upgrade --install \  cert-manager jetstack/cert-manager \  --kube-context "${K8S_CLUSTER_0_CONTEXT_NAME}" \  --namespace cert-manager \  --create-namespace \  --set crds.enabled=true
3

Create a certificate issuer.

kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata:  name: selfsigned-cluster-issuerspec:  selfSigned: {}EOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer selfsigned-cluster-issuer
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata:  name: my-selfsigned-ca  namespace: cert-managerspec:  isCA: true  commonName: my-selfsigned-ca  secretName: root-secret  privateKey:    algorithm: ECDSA    size: 256  issuerRef:    name: selfsigned-cluster-issuer    kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready -n cert-manager certificate my-selfsigned-ca
kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: ClusterIssuermetadata:  name: my-ca-issuerspec:  ca:    secretName: root-secretEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait --for=condition=Ready clusterissuer my-ca-issuer
4

Verify creation of the issuer.

kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -f - <<EOFapiVersion: cert-manager.io/v1kind: Certificatemetadata:  name: test-selfsigned-cert  namespace: cert-managerspec:  dnsNames:    - example.com  secretName: test-selfsigned-cert-tls  issuerRef:    name: my-ca-issuer    kind: ClusterIssuerEOF
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" wait -n cert-manager --for=condition=Ready certificate test-selfsigned-cert
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete -n cert-manager certificate test-selfsigned-cert

/includes/code-examples/outputs/test_gke_multi_cluster_snippets/ra-05_0221_verify_issuer.out

certificate.cert-manager.io/test-selfsigned-cert createdcertificate.cert-manager.io/test-selfsigned-cert condition metcertificate.cert-manager.io "test-selfsigned-cert" deleted from cert-manager namespace
5

Create CA configMap.

mkdir -p certs
openssl s_client -showcerts -verify 2 \-connect downloads.mongodb.com:443 -servername downloads.mongodb.com < /dev/null \| awk '/BEGIN/,/END/{ if(/BEGIN/){a++}; out="certs/cert"a".crt"; print >out}'
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" get secret root-secret -n cert-manager -o jsonpath="{.data['ca\.crt']}" | base64 --decode > certs/ca.crtcat certs/ca.crt certs/cert2.crt certs/cert3.crt  >> certs/mms-ca.crt
kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${MDB_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crtkubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" create cm ca-issuer -n "${OM_NAMESPACE}" --from-file=ca-pem=certs/mms-ca.crt --from-file=mms-ca.crt=certs/mms-ca.crt
Back
Istio Service Mesh
Next
Deploy the Operator
Rate this page

On this page