Skip to content

Commit c9e7c36

Browse files
JuliaMongojwilliams-mongo
JuliaMongo
authored and
jwilliams-mongo
committed
(DOCSP-17256) TLS required for split Horizons (#686)
* (DOCSP-17256) TLS required for split Horizons * Included tech review from Jack Alder * Removed optional for the first step * Address tech review * Removed one more instance of optional, in the Openshift steps * Remove tls steps from sharded procedures too * Edits
1 parent ff3dab1 commit c9e7c36

File tree

4 files changed

+44
-108
lines changed

4 files changed

+44
-108
lines changed

‎source/includes/steps-enable-external-sharded.yaml‎

Lines changed: 17 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -16,46 +16,22 @@ replacement:
1616
k8sExampleFileName: example-sharded-cluster.yaml
1717
k8sResourceType: sharded-cluster
1818
k8sExample: |
19-
20-
.. tabs::
21-
22-
.. tab:: Without TLS
23-
:tabid: k8s-without-tls
24-
25-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
26-
:language: yaml
27-
:start-after: START-exposed-sharded-upper
28-
:end-before: END-exposed-sharded-upper
29-
:linenos:
30-
:lineno-start: 1
31-
:copyable: false
32-
33-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
34-
:language: yaml
35-
:start-after: START-exposed-sharded-lower
36-
:end-before: END-exposed-sharded-lower
37-
:linenos:
38-
:lineno-start: 19
39-
:emphasize-lines: 1
40-
41-
.. tab:: With TLS
42-
:tabid: k8s-with-tls
43-
44-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
45-
:language: yaml
46-
:start-after: START-exposed-sharded-upper
47-
:end-before: END-exposed-sharded-upper
48-
:linenos:
49-
:lineno-start: 1
50-
:copyable: false
51-
52-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
53-
:language: yaml
54-
:start-after: START-exposed-sharded-tls-lower
55-
:end-before: END-exposed-sharded-tls-lower
56-
:linenos:
57-
:lineno-start: 19
58-
:emphasize-lines: 1-6
19+
20+
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
21+
:language: yaml
22+
:start-after: START-exposed-sharded-upper
23+
:end-before: END-exposed-sharded-upper
24+
:linenos:
25+
:lineno-start: 1
26+
:copyable: false
27+
28+
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
29+
:language: yaml
30+
:start-after: START-exposed-sharded-tls-lower
31+
:end-before: END-exposed-sharded-tls-lower
32+
:linenos:
33+
:lineno-start: 19
34+
:emphasize-lines: 1-6
5935
---
6036
level: 4
6137
stepnum: 3
@@ -73,18 +49,7 @@ stepnum: 4
7349
ref: change-replset-resource
7450
content: |
7551
76-
.. tabs::
77-
78-
.. tab:: Without TLS
79-
:tabid: k8s-without-tls
80-
81-
.. include:: /includes/list-tables/resource-keys-external-access-standalone.rst
82-
83-
84-
.. tab:: With TLS
85-
:tabid: k8s-with-tls
86-
87-
.. include:: /includes/list-tables/resource-keys-external-access-sharded.rst
52+
.. include:: /includes/list-tables/resource-keys-external-access-sharded.rst
8853
8954
---
9055
level: 4

‎source/includes/steps-enable-split-horizon-openshift.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22
title: "Deploy a replica set with the |k8s-op-short|."
33
stepnum: 1
44
level: 4
5-
optional: true
65
ref: pre-deploy-replica-set-openshift
76
source:
87
file: steps-enable-split-horizon.yaml

‎source/includes/steps-enable-split-horizon.yaml‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,24 @@
22
title: "Deploy a replica set with the |k8s-op-short|."
33
stepnum: 1
44
level: 4
5-
optional: true
65
ref: pre-deploy-replicaset
76
content: |
87
98
If you haven't deployed a replica set, follow the instructions to
109
:ref:`deploy one <deploy-replica-set>`.
1110
12-
To simplify the configuration, don't enable |tls| with the
13-
:setting:`spec.security.tls.enabled` setting.
11+
You must enable |tls| for the replica set with the
12+
:setting:`spec.security.tls.enabled` setting. The replica set must use
13+
a custom certificate stored with :setting:`spec.security.tls.ca`.
1414
1515
---
1616
title: "Add Subject Alternate Names to your |tls| certificates."
1717
level: 4
1818
stepnum: 2
19-
optional: true
2019
ref: remove-tls-existing-replicasets
2120
content: |
2221
23-
If the |k8s-op-short|-deployed replica set has |tls| enabled and
24-
uses a custom certificate stored with
25-
:setting:`spec.security.tls.ca`,
26-
add each external |dns| name to the certificate |san-dns|.
22+
Add each external |dns| name to the certificate |san-dns|.
2723
2824
---
2925
title: "Create a NodePort for each |k8s-pod|."

‎source/tutorial/connect-from-outside-k8s.txt‎

Lines changed: 23 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,8 @@ Prerequisite
2222
Compatible MongoDB Versions
2323
~~~~~~~~~~~~~~~~~~~~~~~~~~~
2424

25-
For your databases to be accessed outside of |k8s|, they must run one
26-
of the following versions of MongoDB:
27-
28-
- 3.6.17 or later
29-
- 4.0.15 or later
30-
- 4.2.3 or later
25+
For your databases to be accessed outside of |k8s|, they must run
26+
MongoDB 4.2.3 or later.
3127

3228
Procedure
3329
---------
@@ -85,52 +81,32 @@ from outside of the |k8s| cluster depends on the resource.
8581
.. tab::
8682
:tabid: shard
8783

88-
This procedure uses the following example:
89-
90-
.. tabs::
91-
92-
.. tab:: Without TLS
93-
:tabid: k8s-without-tls
94-
95-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
96-
:language: yaml
97-
:start-after: START-exposed-sharded-full
98-
:end-before: END-exposed-sharded-full
99-
:linenos:
100-
:lineno-start: 1
101-
:emphasize-lines: 19
102-
:copyable: false
103-
104-
.. tab:: With TLS
105-
:tabid: k8s-with-tls
106-
107-
.. tip:: **Enable Direct Access to MongoDB hosts Using Split Horizons and TLS**
108-
109-
If the |k8s-op-short| deployed a |tls|\-enabled
110-
sharded cluster, provide the external |dns| names
111-
(|san-dns|\s) for each member.
84+
For this procedure, you must deploy a |tls|\-enabled sharded MongoDB
85+
cluster in the |k8s-op-short|.
86+
Provide the external |dns| names (|san-dns|\s) for each member of
87+
the MongoDB sharded cluster.
11288

113-
The |san-dns| for each MongoDB hosts corresponds to:
89+
The |san-dns| for each MongoDB hosts corresponds to:
11490

115-
.. code-block:: sh
116-
:copyable: false
91+
.. code-block:: sh
92+
:copyable: false
11793

118-
<mdb-resource-name><shard><pod-index>.<external-domain>
119-
<mdb-resource-name><config><pod-index>.<external-domain>
120-
<mdb-resource-name><mongos><pod-index>.<external-domain>
94+
<mdb-resource-name><shard><pod-index>.<external-domain>
95+
<mdb-resource-name><config><pod-index>.<external-domain>
96+
<mdb-resource-name><mongos><pod-index>.<external-domain>
12197

122-
Each |tls| certificate requires the |fqdn|
123-
(|san-dns|) that corresponds to the |fqdn| that
124-
this host has outside the |k8s| cluster.
98+
Each |tls| certificate requires the |fqdn| (|san-dns|) that
99+
corresponds to the |fqdn| that this host has outside the
100+
sharded cluster deployed with the |k8s-op-short|.
125101

126-
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
127-
:language: yaml
128-
:start-after: START-exposed-sharded-tls-full
129-
:end-before: END-exposed-sharded-tls-full
130-
:linenos:
131-
:lineno-start: 1
132-
:emphasize-lines: 19-24
133-
:copyable: false
102+
.. literalinclude:: /includes/code-examples/yaml-files/example-sharded-cluster.yaml
103+
:language: yaml
104+
:start-after: START-exposed-sharded-tls-full
105+
:end-before: END-exposed-sharded-tls-full
106+
:linenos:
107+
:lineno-start: 1
108+
:emphasize-lines: 19-24
109+
:copyable: false
134110

135111
To connect to your |k8s-op-short|-deployed MongoDB sharded
136112
cluster resource from outside of the |k8s| cluster:

0 commit comments

Comments
 (0)