You are looking at the documentation of a prior release. To read the documentation of the latest release, please
visit here.
New to KubeDB? Please start here.
Prerequisite : To configure TLS/SSL in MongoDB
, KubeDB
uses cert-manager
to issue certificates. So first you have to make sure that the cluster has cert-manager
installed. To install cert-manager
in your cluster following steps here.
To issue a certificate, the following crd of cert-manager
is used:
Issuer/ClusterIssuer
: Issuers, and ClusterIssuers represent certificate authorities (CAs) that are able to generate signed certificates by honoring certificate signing requests. All cert-manager certificates require a referenced issuer that is in a ready condition to attempt to honor the request. You can learn more details here.
Certificate
: cert-manager
has the concept of Certificates that define a desired x509 certificate which will be renewed and kept up to date. You can learn more details here.
MongoDB CRD Specification :
KubeDB uses following crd fields to enable SSL/TLS encryption in MongoDB
.
spec:
sslMode
tls:
issuerRef
certificates
clusterAuthMode
Read about the fields in details from mongodb concept,When, sslMode
is set to requireSSL
, the users must specify the tls.issuerRef
field. KubeDB
uses the issuer
or clusterIssuer
referenced in the tls.issuerRef
field, and the certificate specs provided in tls.certificate
to generate certificate secrets using Issuer/ClusterIssuers
specification. These certificates secrets including ca.crt
, tls.crt
and tls.key
etc. are used to configure MongoDB
server, exporter etc. respectively.
The following figure shows how KubeDB
enterprise used to configure TLS/SSL in MongoDB. Open the image in a new tab to see the enlarged version.
Deploying MongoDB with TLS/SSL configuration process consists of the following steps:
At first, a user creates a Issuer/ClusterIssuer
cr.
Then the user creates a MongoDB
cr which refers to the Issuer/ClusterIssuer
cr that the user created in the previous step.
KubeDB
Provisioner operator watches for the MongoDB
cr.
When it finds one, it creates Secret
, Service
, etc. for the MongoDB
database.
KubeDB
Ops-manager operator watches for MongoDB
(5c), Issuer/ClusterIssuer
(5b), Secret
and Service
(5a).
When it finds all the resources(MongoDB
, Issuer/ClusterIssuer
, Secret
, Service
), it creates Certificates
by using tls.issuerRef
and tls.certificates
field specification from MongoDB
cr.
cert-manager
watches for certificates.
When it finds one, it creates certificate secrets tls-secrets
(server, client, exporter secrets etc.) that holds the actual certificate signed by the CA.
KubeDB
Provisioner operator watches for the Certificate secrets tls-secrets
.
When it finds all the tls-secret, it creates the related StatefulSets
so that MongoDB database can be configured with TLS/SSL.
In the next doc, we are going to show a step by step guide on how to configure a MongoDB
database with TLS/SSL.