Skip to content

Commit 3408cb0

Browse files
corryrootjwilliams-mongo
corryroot
authored and
jwilliams-mongo
committed
(DOCSP-26814): Added KMIP details. (#1165)
* (DOCSP-26814): Added KMIP details. * (DOCSP-26814): Incorporated Sebastian's feedback. * (DOCSP-26814): Incorporated Sebastian's feedback. * (DOCSP-26814): Incorporated Zach's feedback. * (DOCSP-26814): Incorporated Łukasz's feedback. * (DOCSP-26814): Incorporated Sebstian's feedback. * (DOCSP-26814): Incorporated Sebstian's feedback.
1 parent fb44f2e commit 3408cb0

8 files changed

+375
-3
lines changed

‎source/includes/options-k8s-replica-set.yaml

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -123,8 +123,8 @@ inherit:
123123
name: spec.backup.mode
124124
program: _shared
125125
file: options-k8s-shared.yaml
126-
---
127126

127+
---
128128
program: k8sRsConf
129129
name: spec.backup
130130
type: collection
@@ -134,8 +134,8 @@ inherit:
134134
name: spec.backup
135135
program: _shared
136136
file: options-k8s-shared.yaml
137-
---
138137

138+
---
139139
program: k8sRsConf
140140
name: spec.backup.autoTerminateOnDeletion
141141
type: boolean
@@ -146,6 +146,51 @@ inherit:
146146
program: _shared
147147
file: options-k8s-shared.yaml
148148

149+
---
150+
program: k8sRsConf
151+
name: spec.backup.encryption
152+
type: object
153+
directive: setting
154+
optional: true
155+
inherit:
156+
name: spec.backup.encryption
157+
program: _shared
158+
file: options-k8s-shared.yaml
159+
160+
---
161+
program: k8sRsConf
162+
name: spec.backup.encryption.kmip
163+
type: object
164+
directive: setting
165+
optional: true
166+
inherit:
167+
name: spec.backup.encryption.kmip
168+
program: _shared
169+
file: options-k8s-shared.yaml
170+
171+
---
172+
program: k8sRsConf
173+
name: spec.backup.encryption.kmip.client
174+
type: object
175+
directive: setting
176+
optional: true
177+
inherit:
178+
name: spec.backup.encryption.kmip.client
179+
program: _shared
180+
file: options-k8s-shared.yaml
181+
182+
---
183+
program: k8sRsConf
184+
name: spec.backup.encryption.kmip.client.clientCertificatePrefix
185+
type: string
186+
directive: setting
187+
description: |
188+
optional: true
189+
inherit:
190+
name: spec.backup.encryption.kmip.client.clientCertificatePrefix
191+
program: _shared
192+
file: options-k8s-shared.yaml
193+
149194
---
150195
program: k8sRsConf
151196
name: spec.backup.snapshotSchedule

‎source/includes/options-k8s-sharded_cluster.yaml

Lines changed: 46 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,8 +79,8 @@ inherit:
7979
name: spec.backup.mode
8080
program: _shared
8181
file: options-k8s-shared.yaml
82-
---
8382

83+
---
8484
program: k8sRsConf
8585
name: spec.backup
8686
type: collection
@@ -91,6 +91,51 @@ inherit:
9191
program: _shared
9292
file: options-k8s-shared.yaml
9393

94+
---
95+
program: k8sRsConf
96+
name: spec.backup.encryption
97+
type: object
98+
directive: setting
99+
optional: true
100+
inherit:
101+
name: spec.backup.encryption
102+
program: _shared
103+
file: options-k8s-shared.yaml
104+
105+
---
106+
program: k8sRsConf
107+
name: spec.backup.encryption.kmip
108+
type: object
109+
directive: setting
110+
optional: true
111+
inherit:
112+
name: spec.backup.encryption.kmip
113+
program: _shared
114+
file: options-k8s-shared.yaml
115+
116+
---
117+
program: k8sRsConf
118+
name: spec.backup.encryption.kmip.client
119+
type: object
120+
directive: setting
121+
optional: true
122+
inherit:
123+
name: spec.backup.encryption.kmip.client
124+
program: _shared
125+
file: options-k8s-shared.yaml
126+
127+
---
128+
program: k8sRsConf
129+
name: spec.backup.encryption.kmip.client.clientCertificatePrefix
130+
type: string
131+
directive: setting
132+
description: |
133+
optional: true
134+
inherit:
135+
name: spec.backup.encryption.kmip.client.clientCertificatePrefix
136+
program: _shared
137+
file: options-k8s-shared.yaml
138+
94139
---
95140
program: k8sRsConf
96141
name: spec.backup.snapshotSchedule

‎source/includes/options-k8s-shared.yaml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,48 @@ description: |
187187
MongoDB custom resource while the :setting:`spec.backup.mode` setting
188188
is set to ``enabled``.
189189
190+
---
191+
program: _shared
192+
name: spec.backup.encryption
193+
type: object
194+
directive: setting
195+
description: |
196+
197+
Object that contains the backup encryption configuration settings.
198+
199+
---
200+
program: _shared
201+
name: spec.backup.encryption.kmip
202+
type: object
203+
directive: setting
204+
description: |
205+
206+
Object that contains the |kmip| backup encryption configuration
207+
settings. To learn more, see :ref:`configure-kmip-backup-encryption`.
208+
209+
---
210+
program: _shared
211+
name: spec.backup.encryption.kmip.client
212+
type: object
213+
directive: setting
214+
description: |
215+
216+
Object that contains the |kmip| backup encryption client
217+
configuration settings.
218+
219+
---
220+
program: _shared
221+
name: spec.backup.encryption.kmip.client.clientCertificatePrefix
222+
type: string
223+
directive: setting
224+
description: |
225+
226+
Human-readable prefix to construct a |kmip| client certificate and
227+
corresponding secret names. The |kmip| client certificate has the
228+
``<clientCertificatePrefix>-<CR-name>`` format. The |kmip| client
229+
certificate password has the
230+
``<clientCertificatePrefix>-<CR-Name>-kmip-client-password`` format.
231+
190232
---
191233
program: _shared
192234
name: spec.backup.snapshotSchedule

‎source/includes/steps-configure-kmip-backup-encryption.yaml

Lines changed: 176 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,176 @@
1+
title: "Create the ConfigMap of the |certauth|."
2+
stepnum: 1
3+
level: 4
4+
ref: config-map-ca-kmip
5+
content: |
6+
7+
Run the following command:
8+
9+
.. code-block:: sh
10+
11+
kubectl -n mongodb create configmap mongodb-kmip-certificate-authority-pem --from-file=ca-pem
12+
13+
---
14+
title: "Configure the |onprem| custom resource to use |kmip| backup encryption."
15+
stepnum: 2
16+
level: 4
17+
ref: config-om-kmip
18+
content: |
19+
20+
Configure the :opsmgrkube:`spec.backup.encryption.kmip` settings.
21+
22+
.. code-block:: yaml
23+
:linenos:
24+
:emphasize-lines: 11-14
25+
26+
apiVersion: mongodb.com/v1
27+
kind: MongoDBOpsManager
28+
metadata:
29+
name: om-backup-kmip
30+
spec:
31+
replicas: 1
32+
version: 6.0.0
33+
adminCredentials: ops-manager-admin-secret
34+
backup:
35+
encryption:
36+
kmip:
37+
server:
38+
url: kmip.corp.mongodb.com:5696
39+
ca: mongodb-kmip-certificate-authority-pem
40+
41+
---
42+
title: "Save your |onprem| config file."
43+
stepnum: 3
44+
level: 4
45+
ref: save-config-file-kmip
46+
47+
---
48+
title: "Apply changes to your |onprem| deployment."
49+
stepnum: 4
50+
level: 4
51+
ref: apply-kmip-changes-om-k8s
52+
content: |
53+
54+
Invoke the following ``kubectl`` command on the filename of the
55+
|onprem| resource definition:
56+
57+
.. code-block:: sh
58+
59+
kubectl apply -f <opsmgr-resource>.yaml
60+
61+
---
62+
stepnum: 5
63+
title: "Check the status of your |onprem| resources."
64+
level: 4
65+
ref: track-k8s-deployment-om-kmip-config
66+
content: |
67+
68+
Run the following command:
69+
70+
.. code-block:: sh
71+
72+
kubectl get om <resource-name> -o yaml -w
73+
74+
---
75+
title: "Create the |k8s-secret| of the client certificate and private key."
76+
stepnum: 6
77+
level: 4
78+
ref: client-cert-kmip
79+
content: |
80+
81+
Run the following command:
82+
83+
.. code-block:: sh
84+
85+
kubectl -n mongodb create secret tls mongodb-kmip-client-pem-my-replica-set-client-kmip \
86+
--cert=<path-to-cert-file> \
87+
--key=<path-to-key-file>
88+
89+
The client certificate |k8s-secret| name has the following naming
90+
convention inferred from the ``MongoDB`` |k8s-crd|:
91+
92+
.. code-block:: sh
93+
94+
<clientCertificatePrefix>-<objectMeta.name>-client-kmip
95+
96+
.. list-table::
97+
:widths: 40 60
98+
99+
* - ``clientCertificatePrefix``
100+
- Human-readable label specified in the
101+
:setting:`spec.backup.encryption.kmip.client.clientCertificatePrefix` field of the ``MongoDB`` |k8s-crd|.
102+
103+
* - ``objectMeta.name``
104+
- Human-readable label specified in the :setting:`metadata.name`
105+
field of the ``MongoDB`` |k8s-crd|.
106+
107+
* - ``client-kmip``
108+
- Fixed suffix that the |k8s-op-short| assumes.
109+
110+
To learn more, see :k8sdocs:`kubernetes.io/tls
111+
</concepts/configuration/secret/#tls-secrets>`.
112+
113+
---
114+
title: "Configure your MongoDB database deployment."
115+
stepnum: 7
116+
level: 4
117+
ref: config-mdb-deployment-kmip
118+
content: |
119+
120+
Configure the :setting:`spec.backup.encryption.kmip` settings.
121+
122+
.. code-block:: yaml
123+
:linenos:
124+
:emphasize-lines: 11-13
125+
126+
apiVersion: mongodb.com/v1
127+
kind: MongoDB
128+
metadata:
129+
name: my-replica-set
130+
spec:
131+
members: 3
132+
version: 4.0.20
133+
type: ReplicaSet
134+
backup:
135+
encryption:
136+
kmip:
137+
client:
138+
clientCertificatePrefix: mongodb-kmip-client-pem
139+
140+
To learn more, see :ref:`deploy a replica set <deploy-replica-set>`
141+
or :ref:`deploy a sharded cluster <deploy-sharded-cluster>`.
142+
143+
---
144+
title: "Save your MongoDB database deployment config file."
145+
stepnum: 8
146+
level: 4
147+
ref: save-deployment-config-file-kmip
148+
149+
---
150+
title: "Apply changes to your MongoDB database deployment."
151+
stepnum: 9
152+
level: 4
153+
ref: apply-kmip-changes-mdb-database-deployment
154+
content: |
155+
156+
Invoke the following ``kubectl`` command on the filename of the
157+
|onprem| resource definition:
158+
159+
.. code-block:: sh
160+
161+
kubectl apply -f <mdb-database-deployment>.yaml
162+
163+
---
164+
stepnum: 10
165+
title: "Check the status of your MongoDB database deployment."
166+
level: 4
167+
ref: track-mdb-deployment-kmip-config
168+
content: |
169+
170+
Run the following command:
171+
172+
.. code-block:: sh
173+
174+
kubectl get mdb <resource-name> -o yaml -w
175+
176+
...

‎source/om-resources.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,9 @@ Deploy and Configure Ops Manager Resources
3939
Configure queryable backups for |onprem| deployments created with the
4040
|k8s-op-short|.
4141

42+
:ref:`configure-kmip-backup-encryption`
43+
Configure |kmip| backup encryption.
44+
4245
:ref:`cert-manager-integration`
4346
Configure automated certificate renewal for |onprem| deployments with
4447
``cert-manager``.
@@ -54,4 +57,5 @@ Deploy and Configure Ops Manager Resources
5457
/tutorial/deploy-om-container-remote-mode
5558
/tutorial/deploy-om-container-local-mode
5659
/tutorial/configure-om-queryable-backups
60+
/tutorial/configure-kmip-backup-encryption
5761
/tutorial/cert-manager-integration

0 commit comments

Comments
 (0)