Skip to content

Latest commit

 

History

History
104 lines (90 loc) · 5.01 KB

README.md

File metadata and controls

104 lines (90 loc) · 5.01 KB
Raw

Build Status David

Mongo Kubernetes Replica Set Sidecar

This project is as a PoC to setup a MongoDB replica set using Kubernetes. It should handle resizing of any type and be resilient to the various conditions both MongoDB and Kubernetes can find themselves in.

It's a fork of cvallance/mongo-k8s-sidecar with (many) changes and improvements.

How to use it

The docker image is hosted on Docker Hub and can be found here: https://hub.docker.com/r/morphy/k8s-mongo-sidecar

An example Kubernetes replication controller can be found in the examples directory on GitHub: https://github.com/morphy2k/k8s-mongo-sidecar

Settings

Environment Variable Required Default Description
KUBERNETES_CLUSTER_DOMAIN NO cluster.local This allows the specification of a custom cluster domain name. Used for the creation of a stable network ID of the k8s Mongo pods. An example could be: "kube.local".
KUBERNETES_SERVICE_NAME YES mongo This should point to the MongoDB Kubernetes (headless) service that identifies all the pods.
KUBERNETES_NAMESPACE NO The namespace to look up pods in. Not setting it will search for pods in all namespaces.
KUBERNETES_POD_LABELS YES This should be a be a comma separated list of key values the same as the podTemplate labels. See above for example.
MONGO_PORT NO 27017 Configures the mongo port, allows the usage of non-standard ports.
MONGO_CONFIG_SVR NO false Configures the configsvr variable when initializing the replicaset.
MONGO_DATABASE NO local Configures the mongo authentication database
MONGO_USERNAME NO Configures the mongo username for authentication
MONGO_PASSWORD NO Configures the mongo password for authentication
MONGO_AUTH_MECHANISM NO SCRAM-SHA-1 Configures the mongo authentication mechanism
MONGO_SSL NO false Enable MongoDB SSL connection
MONGO_SSL_CA NO Path to SSL CA Certificate
MONGO_SSL_CERT NO Path to SSL Certificate
MONGO_SSL_KEY NO Path to SSL Key
MONGO_SSL_PASS NO SSL Certificate pass phrase
MONGO_SSL_CRL NO Path to SSL Certificate revocation list
MONGO_SSL_IDENTITY_CHECK NO true Server identity check during SSL. Checks server's hostname against the certificate
SIDECAR_SLEEP_SECONDS NO 5 This is how long to sleep between work cycles.
SIDECAR_UNHEALTHY_SECONDS NO 15 This is how many seconds a replica set member has to get healthy before automatically being removed from the replica set.

MongoDB SSL

The following is an example of how you would update the mongo command enabling SSL and using a certificate obtained from a secret and mounted at /data/ssl/mongo/

Command

        - name: my-mongo
          image: mongo
          command:
            - mongod
          args:
            - "--replSet=rs0"
            - "--sslMode=requireSSL"
            - "--sslCAFile=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
            - "--sslPEMKeyFile=/data/ssl/mongo/combined.pem"
            - "--smallfiles"
            - "--noprealloc"
            - "--bind_ip=0.0.0.0"

Environment variables, Volume & Volume Mounts

          volumeMounts:
            - name: mongo-persistent-storage
              mountPath: /data/db
            - name: mongo-ssl
              mountPath: /data/ssl/mongo
        - name: mongo-sidecar
          image: morphy/k8s-mongo-sidecar
          env:
            - name: KUBERNETES_POD_LABELS
              value: "role=mongo,environment=prod"
            - name: MONGO_SSL
              value: "true"
            - name: MONGO_SSL_CA
              value: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
            - name: "MONGO_SSL_CERT"
              value: "/data/ssl/mongo/cert.pem"
            - name: MONGO_SSL_KEY
              value: "/data/ssl/mongo/key.pem"
          volumeMounts:
            - name: mongo-ssl
              mountPath: /data/ssl/mongo
      volumes:
        - name: mongo-ssl
          secret:
            secretName: mongo-ssl
            defaultMode: 256 # file permission 0400

Creating Secret for SSL

  1. Generate a certificate with your Kubernetes cluster as CA that is explained here
  2. Merge your certificate and key named as cert.pem and key.pem into a single file
cat cert.pem key.pem > combined.pem
  1. Push the secrets to your cluster
kubectl create secret generic mongo-ssl \
--from-file=combined.pem \
--from-file=key.pem \
--from-file=cert.pem