You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -29,21 +29,21 @@ See the [documentation](/docs) to learn how to:
29
29
1.[Create a database user](/docs/users.md) with SCRAM authentication.
30
30
1.[Secure MongoDB resource connections](/docs/secure.md) using TLS.
31
31
32
-
*NOTE: [MongoDB Enterprise Kubernetes Operator](https://docs.mongodb.com/kubernetes-operator/master/) docs are for the enterprise operator use case and NOT for the community operator. In addition to the docs mentioned above, you can refer to this [blog post](https://www.mongodb.com/blog/post/run-secure-containerized-mongodb-deployments-using-the-mongo-db-community-kubernetes-oper) as well to learn more about community operator deployment*
32
+
*NOTE: [MongoDB Enterprise Kubernetes Operator](https://www.mongodb.com/docs/kubernetes-operator/master/) docs are for the enterprise operator use case and NOT for the community operator. In addition to the docs mentioned above, you can refer to this [blog post](https://www.mongodb.com/blog/post/run-secure-containerized-mongodb-deployments-using-the-mongo-db-community-kubernetes-oper) as well to learn more about community operator deployment*
33
33
34
34
## Supported Features
35
35
36
36
The MongoDB Community Kubernetes Operator supports the following features:
Copy file name to clipboardExpand all lines: SECURITY.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,6 @@
3
3
## Reporting a Vulnerability
4
4
5
5
Any security concerns or vulnerabilities discovered in one of MongoDB’s products or hosted services
6
-
can be responsibly disclosed by utilizing one of the methods described in our [create a vulnerability report](https://docs.mongodb.com/manual/tutorial/create-a-vulnerability-report/) docs page.
6
+
can be responsibly disclosed by utilizing one of the methods described in our [create a vulnerability report](https://www.mongodb.com/docs/manual/tutorial/create-a-vulnerability-report/) docs page.
7
7
8
8
While we greatly appreciate community reports regarding security issues, at this time MongoDB does not provide compensation for vulnerability reports.
Copy file name to clipboardExpand all lines: docs/architecture.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -12,13 +12,13 @@ The MongoDB Community Kubernetes Operator is a [Custom Resource Definition](http
12
12
13
13
You create and update MongoDBCommunity resources by defining a MongoDBCommunity resource definition. When you apply the MongoDBCommunity resource definition to your Kubernetes environment, the Operator:
14
14
15
-
1. Creates a [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) that contains one [pod](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) for each [replica set](https://docs.mongodb.com/manual/replication/) member.
15
+
1. Creates a [StatefulSet](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/) that contains one [pod](https://kubernetes.io/docs/concepts/workloads/pods/pod-overview/) for each [replica set](https://www.mongodb.com/docs/manual/replication/) member.
16
16
1. Writes the Automation configuration as a [Secret](https://kubernetes.io/docs/concepts/configuration/secret/) and mounts it to each pod.
17
17
1. Creates one [init container](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) and two [containers](https://kubernetes.io/docs/concepts/containers/overview/) in each pod:
18
18
19
19
- An init container which copies the `cmd/versionhook` binary to the main `mongod` container. This is run before `mongod` starts to handle [version upgrades](#example-mongodb-version-upgrade).
20
20
21
-
- A container for the [`mongod`](https://docs.mongodb.com/manual/reference/program/mongod/index.html) process binary. `mongod` is the primary daemon process for the MongoDB system. It handles data requests, manages data access, and performs background management operations.
21
+
- A container for the [`mongod`](https://www.mongodb.com/docs/manual/reference/program/mongod/index.html) process binary. `mongod` is the primary daemon process for the MongoDB system. It handles data requests, manages data access, and performs background management operations.
22
22
23
23
- A container for the MongoDB Agent. The Automation function of the MongoDB Agent handles configuring, stopping, and restarting the `mongod` process. The MongoDB Agent periodically polls the `mongod` to determine status and can deploy changes as needed.
24
24
@@ -59,7 +59,7 @@ When you update the MongoDB version in your resource definition and reapply it t
59
59
60
60
1. The Operator updates the [image](https://kubernetes.io/docs/concepts/containers/images/) specification to the new version of MongoDB and writes a new Automation configuration ConfigMap to each pod.
61
61
62
-
1. The MongoDB Agent chooses the first pod to upgrade and stops the `mongod` process using a local connection and [`db.shutdownServer`](https://docs.mongodb.com/manual/reference/method/db.shutdownServer/#db.shutdownServer).
62
+
1. The MongoDB Agent chooses the first pod to upgrade and stops the `mongod` process using a local connection and [`db.shutdownServer`](https://www.mongodb.com/docs/manual/reference/method/db.shutdownServer/#db.shutdownServer).
63
63
64
64
1. Kubernetes will restart the `mongod` container causing the version change hook to run and check the state of the MongoDB Agent. If the MongoDB Agent expects the `mongod` process to start with a new version, the hook uses a Kubernetes API call to delete the pod.
Copy file name to clipboardExpand all lines: docs/deploy-configure.md
+12-12
Original file line number
Diff line number
Diff line change
@@ -33,7 +33,7 @@ To deploy your first replica set:
33
33
| Variable | Description | Value in Sample |
34
34
|----|----|----|
35
35
|`<metadata.name>`| Name of the MongoDB database resource. |`example-mongodb`|
36
-
|`<auth-db>`|[Authentication database](https://docs.mongodb.com/manual/core/security-users/#std-label-user-authentication-database) where you defined the database user. |`admin`|
36
+
|`<auth-db>`|[Authentication database](https://www.mongodb.com/docs/manual/core/security-users/#std-label-user-authentication-database) where you defined the database user. |`admin`|
37
37
|`<username>`| Username of the database user. |`my-user`|
38
38
39
39
Update the variables in the following command, then run it to retrieve a user's connection strings to the replica set from the secret:
@@ -45,7 +45,7 @@ To deploy your first replica set:
The command returns the replica set's standard and DNS seed list [connection strings](https://docs.mongodb.com/manual/reference/connection-string/#connection-string-formats) in addition to the user's name and password:
48
+
The command returns the replica set's standard and DNS seed list [connection strings](https://www.mongodb.com/docs/manual/reference/connection-string/#connection-string-formats) in addition to the user's name and password:
49
49
50
50
```json
51
51
{
@@ -56,7 +56,7 @@ To deploy your first replica set:
56
56
}
57
57
```
58
58
59
-
**NOTE**: The Community Kubernetes Operator sets the [`ssl` connection option](https://docs.mongodb.com/manual/reference/connection-string/#connection-options) to `true` if you [Secure MongoDBCommunity Resource Connections using TLS](secure.md#secure-mongodbcommunity-resource-connections-using-tls).</br></br>
59
+
**NOTE**: The Community Kubernetes Operator sets the [`ssl` connection option](https://www.mongodb.com/docs/manual/reference/connection-string/#connection-options) to `true` if you [Secure MongoDBCommunity Resource Connections using TLS](secure.md#secure-mongodbcommunity-resource-connections-using-tls).</br></br>
60
60
61
61
You can use the connection strings in this secret in your application:
62
62
@@ -84,7 +84,7 @@ To deploy your first replica set:
84
84
user@app:~$
85
85
```
86
86
87
-
6. Use one of the connection strings returned in step 4 to connect to the replica set. The following example uses [`mongosh`](https://docs.mongodb.com/mongodb-shell/) to connect to a replica set:
87
+
6. Use one of the connection strings returned in step 4 to connect to the replica set. The following example uses [`mongosh`](https://www.mongodb.com/docs/mongodb-shell/) to connect to a replica set:
To add [arbiters](https://docs.mongodb.com/manual/core/replica-set-arbiter/) to your replica set, add the `spec.arbiters` field to your MongoDBCommunity resource definition.
139
+
To add [arbiters](https://www.mongodb.com/docs/manual/core/replica-set-arbiter/) to your replica set, add the `spec.arbiters` field to your MongoDBCommunity resource definition.
140
140
141
141
The value of the `spec.arbiters` field must be:
142
142
@@ -201,9 +201,9 @@ You can upgrade the major, minor, and/or feature compatibility versions of your
201
201
202
202
- To upgrade your resource's major and/or minor versions, set the `spec.version` setting to the desired MongoDB version. Make sure to specify a full image tag, such as `5.0.3`. Setting the `spec.version` to loosely-defined tags such as `5.0` is not currently supported.
203
203
204
-
- To modify your resource's [feature compatibility version](https://docs.mongodb.com/manual/reference/command/setFeatureCompatibilityVersion/), set the `spec.featureCompatibilityVersion` setting to the desired version.
204
+
- To modify your resource's [feature compatibility version](https://www.mongodb.com/docs/manual/reference/command/setFeatureCompatibilityVersion/), set the `spec.featureCompatibilityVersion` setting to the desired version.
205
205
206
-
If you update `spec.version` to a later version, consider setting `spec.featureCompatibilityVersion` to the current working MongoDB version to give yourself the option to downgrade if necessary. To learn more about feature compatibility, see [`setFeatureCompatibilityVersion`](https://docs.mongodb.com/manual/reference/command/setFeatureCompatibilityVersion/) in the MongoDB Manual.
206
+
If you update `spec.version` to a later version, consider setting `spec.featureCompatibilityVersion` to the current working MongoDB version to give yourself the option to downgrade if necessary. To learn more about feature compatibility, see [`setFeatureCompatibilityVersion`](https://www.mongodb.com/docs/manual/reference/command/setFeatureCompatibilityVersion/) in the MongoDB Manual.
207
207
208
208
### Example
209
209
@@ -239,7 +239,7 @@ To upgrade this resource from `4.0.6` to `4.2.7`:
239
239
featureCompatibilityVersion: "4.0"
240
240
```
241
241
242
-
**NOTE:** Setting `featureCompatibilityVersion` to `4.0` disables [4.2 features incompatible with MongoDB 4.0](https://docs.mongodb.com/manual/release-notes/4.2-compatibility/#compatibility-enabled).
242
+
**NOTE:** Setting `featureCompatibilityVersion` to `4.0` disables [4.2 features incompatible with MongoDB 4.0](https://www.mongodb.com/docs/manual/release-notes/4.2-compatibility/#compatibility-enabled).
243
243
244
244
2. Reapply the configuration to Kubernetes:
245
245
```
@@ -258,7 +258,7 @@ See [here](../deploy/openshift/operator_openshift.yaml) for an example of how to
258
258
259
259
## Define a Custom Database Role
260
260
261
-
You can define [custom roles](https://docs.mongodb.com/manual/core/security-user-defined-roles/) to give you fine-grained access control over your MongoDB database resource.
261
+
You can define [custom roles](https://www.mongodb.com/docs/manual/core/security-user-defined-roles/) to give you fine-grained access control over your MongoDB database resource.
262
262
263
263
**NOTE**: Custom roles are scoped to a single MongoDB database resource.
264
264
@@ -269,14 +269,14 @@ To define a custom role:
269
269
| Key | Type | Description | Required? |
270
270
|----|----|----|----|
271
271
| `spec.security.authentication.ignoreUnknownUsers` | boolean | Flag that indicates whether you can add users that don't exist in the `MongoDBCommunity` resource. If omitted, defaults to `true`. | No |
272
-
| `spec.security.roles` | array | Array that defines [custom roles](https://docs.mongodb.com/manual/core/security-user-defined-roles/) roles that give you fine-grained access control over your MongoDB deployment. | Yes |
272
+
| `spec.security.roles` | array | Array that defines [custom roles](https://www.mongodb.com/docs/manual/core/security-user-defined-roles/) roles that give you fine-grained access control over your MongoDB deployment. | Yes |
273
273
| `spec.security.roles.role` | string | Name of the custom role. | Yes |
274
274
| `spec.security.roles.db` | string | Database in which you want to store the user-defined role. | Yes |
275
275
| `spec.security.roles.authenticationRestrictions` | array | Array that defines the IP address from which and to which users assigned this role can connect. | No |
276
276
| `spec.security.roles.authenticationRestrictions.clientSource` | array | Array of IP addresses or CIDR blocks from which users assigned this role can connect. <br><br> MongoDB servers reject connection requests from users with this role if the requests come from a client that is not present in this array. | No |
277
277
| `spec.security.roles.authenticationRestrictions.serverAddress` | array | Array of IP addresses or CIDR blocks to which users assigned this role can connect. <br><br> MongoDB servers reject connection requests from users with this role if the client requests to connect to a server that is not present in this array. | No |
278
-
| `spec.security.roles.privileges` | array | List of actions that users granted this role can perform. For a list of accepted values, see [Privilege Actions](https://docs.mongodb.com/manual/reference/privilege-actions/#database-management-actions) in the MongoDB Manual for the MongoDB versions you deploy with the Kubernetes Operator. | Yes |
279
-
| `spec.security.roles.privileges.actions` | array | Name of the role. Valid values are [built-in roles](https://docs.mongodb.com/manual/reference/built-in-roles/#built-in-roles). | Yes |
278
+
| `spec.security.roles.privileges` | array | List of actions that users granted this role can perform. For a list of accepted values, see [Privilege Actions](https://www.mongodb.com/docs/manual/reference/privilege-actions/#database-management-actions) in the MongoDB Manual for the MongoDB versions you deploy with the Kubernetes Operator. | Yes |
279
+
| `spec.security.roles.privileges.actions` | array | Name of the role. Valid values are [built-in roles](https://www.mongodb.com/docs/manual/reference/built-in-roles/#built-in-roles). | Yes |
280
280
| `spec.security.roles.privileges.resource.database`| string | Database for which the privilege `spec.security.roles.privileges.actions` apply. An empty string (`""`) indicates that the privilege actions apply to all databases. <br><br> If you provide a value for this setting, you must also provide a value for `spec.security.roles.privileges.resource.collection`. | Conditional |
281
281
| `spec.security.roles.privileges.resource.collection`| string | Collection for which the privilege `spec.security.roles.privileges.actions` apply. An empty string (`""`) indicates that the privilege actions apply to all of the database's collections.<br><br> If you provide a value for this setting, you must also provide a value for `spec.security.roles.privileges.resource.database`. | Conditional |
282
282
| `spec.security.roles.privileges.resource.cluster`| string | Flag that indicates that the privilege `spec.security.roles.privileges.actions` apply to all databases and collections in the MongoDB deployment. If omitted, defaults to `false`.<br><br> If set to `true`, do not provide values for `spec.security.roles.privileges.resource.database` and `spec.security.roles.privileges.resource.collection`. | Conditional |
Copy file name to clipboardExpand all lines: docs/secure.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -54,7 +54,7 @@ To secure connections to MongoDBCommunity resources using TLS:
54
54
1. Add the following fields to the MongoDBCommunity resource definition:
55
55
56
56
- `spec.security.tls.enabled`: Encrypts communications using TLS certificates between MongoDB hosts in a replica set and client applications and MongoDB deployments. Set to `true`.
57
-
- `spec.security.tls.optional`: (**Optional**) Enables the members of the replica set to accept both TLS and non-TLS client connections. Equivalent to setting the MongoDB[`net.tls.mode`](https://docs.mongodb.com/manual/reference/configuration-options/#net.tls.mode) setting to `preferSSL`. If omitted, defaults to `false`.
57
+
- `spec.security.tls.optional`: (**Optional**) Enables the members of the replica set to accept both TLS and non-TLS client connections. Equivalent to setting the MongoDB[`net.tls.mode`](https://www.mongodb.com/docs/manual/reference/configuration-options/#net.tls.mode) setting to `preferSSL`. If omitted, defaults to `false`.
0 commit comments