Skip to content

Commit dc0a885

Browse files
JuliaMongoJuliaMongo
authored
(DOCSP-20859) New TLS for Multi-Cluster (#846)
* Adding content * Fixing build * Build issues * Third attempt * fixing build * Hope this fixed the build * sigh * sigh * Fixed the error -- thank you John W * Continuing to fix the build for a diff error * Removing unneeded nested TOC * warnings now * Fixing the TOC now * Edits, moving files around in the filesystem * Address tech review * Address copy review
1 parent 472c2b1 commit dc0a885

11 files changed

+208
-330
lines changed

‎source/includes/prereqs/custom-ca-prereqs-multi-cluster-rs-tls-only.rst

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
- Generate one |tls| certificate for a ``MongoDBMulti`` resource.
2+
3+
For each |k8s| service corresponding to each Pod in each member cluster,
4+
add |san-dns|\s to the certificate.
5+
6+
In your |tls| certificate, the |san-dns| for each |k8s| service must
7+
use the following format:
8+
9+
.. include:: /includes/prereqs/san-format-multi-cluster.rst
10+
11+
You must possess the |certauth| certificate and the key that you used
12+
to sign your |tls| certificates.
13+

‎source/includes/prereqs/san-format-multi-cluster.rst

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
.. code-block:: none
2+
3+
<metadata.name>-<member_cluster_index>-<n>-svc.<namespace>.svc.cluster.local
4+
5+
where ``n`` ranges from ``0`` to ``clusterSpecList[member_cluster_index].members - 1``.
6+
7+

‎source/includes/steps-deploy-k8s-multi-cluster-rs-tls-custom-renew.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
2+
---
3+
stepnum: 1
4+
ref: renew-k8s-rs-tls-secret
5+
source:
6+
file: steps-multi-cluster-source.yaml
7+
ref: renew-mc-rs-tls-secret
8+
9+
...

‎source/includes/steps-deploy-k8s-multi-cluster-rs-tls-custom.yaml

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
---
2+
stepnum: 1
3+
ref: create-k8s-mc-rs-tls-secret
4+
title: "Create the secret for the TLS certificate of your ``MongoDBMulti`` custom resource."
5+
level: 4
6+
content: |
7+
Run the ``kubectl`` command to create a new secret that stores the
8+
MongoDB multi-cluster resource's certificate:
9+
10+
.. code-block:: sh
11+
12+
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
13+
--namespace=<metadata.namespace> \
14+
create secret tls <prefix>-<metadata.name>-cert \
15+
--cert=<resource-tls-cert> \
16+
--key=<resource-tls-key>
17+
18+
---
19+
stepnum: 2
20+
ref: create-k8s-mc-rs-tls-configmap
21+
title: "Create the ConfigMap to link your CA with your ``MongoDBMulti`` custom resource."
22+
level: 4
23+
content: |
24+
Run the ``kubectl`` command to link your |certauth| to your ``MongoDBMulti`` custom resource:
25+
26+
.. code-block:: sh
27+
28+
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
29+
--namespace=<metadata.namespace> \
30+
create configmap custom-ca -from-file=ca-pem
31+
32+
---
33+
stepnum: 3
34+
ref: update-mongodbmulti-resource
35+
title: "Update your ``MongoDBMulti`` custom resource."
36+
level: 4
37+
content: |
38+
39+
:ref:`Update your MongoDB multi-cluster resource <k8s-edit-database-resource>`
40+
with :ref:`security settings <security-settings>` from the |k8s-op-short|
41+
MongoDB resource specification. The resulting configuration should look as
42+
follows:
43+
44+
.. code-block:: yaml
45+
46+
apiVersion: mongodb.com/v1
47+
kind: MongoDBMulti
48+
metadata:
49+
name: multi-replica-set
50+
spec:
51+
version: 4.4.0-ent
52+
type: ReplicaSet
53+
persistent: false
54+
duplicateServiceObjects: true
55+
credentials: my-credentials
56+
opsManager:
57+
configMapRef:
58+
name: my-project
59+
security:
60+
tls:
61+
ca: custom-ca
62+
certsSecretPrefix: <prefix>
63+
clusterSpecList:
64+
clusterSpecs:
65+
- clusterName: ${MDB_CLUSTER_1_FULL_NAME}
66+
members: 3
67+
- clusterName: ${MDB_CLUSTER_2_FULL_NAME}
68+
members: 2
69+
- clusterName: ${MDB_CLUSTER_3_FULL_NAME}
70+
members: 3
71+
72+
The |k8s-op-short| copies the ConfigMap with the |certauth| created in
73+
the central cluster to each member cluster, generates a concatenated
74+
|pem| secret, and distributes it to the member clusters.
75+
76+
---
77+
stepnum: 4
78+
level: 4
79+
ref: verify-mc-resources-tls
80+
source:
81+
file: steps-multi-cluster-source.yaml
82+
ref: verify-mdb-resources-mc
83+
84+
...

‎source/includes/steps-multi-cluster-source.yaml

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,11 +239,34 @@ content: |
239239
--namespace mongodb
240240
241241
#. In the central cluster, run the following commands to verify that
242-
the MongoDBMulti ``CustomResource`` is in the running state:
242+
the ``MongoDBMulti`` custom resource is in the running state:
243243
244244
.. code-block:: sh
245245
246246
kubectl --context=$MDB_CENTRAL_CLUSTER_FULL_NAME \
247247
--namespace mongodb \
248248
get mdbm multi-replica-set -o yaml -w
249+
250+
---
251+
252+
title: "Renew the |k8s-secret| for a ``MongoDBMulti`` resource."
253+
stepnum: 0
254+
level: 4
255+
ref: renew-mc-rs-tls-secret
256+
content: |
257+
258+
Run this ``kubectl`` command to renew an existing |k8s-secret| that
259+
stores the ``MongoDBMulti`` resource's certificates:
260+
261+
.. code-block:: sh
262+
263+
kubectl --context $MDB_CENTRAL_CLUSTER_FULL_NAME \
264+
--namespace=<metadata.namespace> \
265+
create secret tls <prefix>-<metadata.name>-cert \
266+
--cert=<resource-tls-cert> \
267+
--key=<resource-tls-key> \
268+
--dry-run=client \
269+
-o yaml |
270+
kubectl apply -f -
271+
249272
...

‎source/includes/steps-multi-cluster-tls-openssl.yaml

Lines changed: 0 additions & 181 deletions
This file was deleted.

0 commit comments

Comments
 (0)