mirror of
https://github.com/kerberos-io/deployment.git
synced 2026-11-07 20:30:26 +00:00
Cédric VerstraetenandCopilot
674875a754
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
58 lines
2.1 KiB
Markdown
58 lines
2.1 KiB
Markdown
# Amazon DocumentDB
|
|
|
|
[Amazon DocumentDB](https://aws.amazon.com/documentdb/) is a managed, MongoDB
|
|
compatible database. It can be used as the metadata store for Hub
|
|
instead of a self-hosted MongoDB.
|
|
|
|
## Things to know
|
|
|
|
- **Not reachable from outside its VPC.** DocumentDB has no public endpoint, so
|
|
the Hub services must run inside (or be peered with) the same VPC.
|
|
- **TLS is enabled by default.** Clients must trust the Amazon RDS certificate
|
|
authority bundle:
|
|
`https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`.
|
|
- **Not every MongoDB feature is available.** Retryable writes, the MongoDB
|
|
Stable API, geospatial queries/indexes and complex `$lookup` pipelines are
|
|
unsupported. Set `mongodb.flavor: "documentdb"` and
|
|
`mongodb.retryWrites: "false"` in the hub chart so those code paths are
|
|
disabled.
|
|
|
|
## Provisioning
|
|
|
|
The [`amazon-eks-documentdb`](../amazon-eks-documentdb/README.md) Terraform
|
|
stack creates a VPC, an EKS cluster and a DocumentDB cluster with TLS enforced,
|
|
and outputs a ready to paste `mongodb` values block for the hub helm chart.
|
|
|
|
## Connecting Hub
|
|
|
|
Configure the database through `mongodb.uri` (not `mongodb.host`) and point the
|
|
chart at the CA bundle:
|
|
|
|
```bash
|
|
curl -O https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
|
|
kubectl create secret generic mongodb-ca --from-file=global-bundle.pem -n kerberos-hub
|
|
```
|
|
|
|
```yaml
|
|
mongodb:
|
|
flavor: "documentdb"
|
|
retryWrites: "false"
|
|
uri: "mongodb://<user>:<password>@<cluster>.docdb.amazonaws.com:27017/?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
|
|
adminDatabase: "admin"
|
|
authenticationMechanism: "SCRAM-SHA-1"
|
|
tls:
|
|
enabled: true
|
|
existingSecret: "mongodb-ca"
|
|
caFileName: "global-bundle.pem"
|
|
mountPath: "/certs"
|
|
```
|
|
|
|
The chart mounts the bundle read-only into every workload that talks to
|
|
MongoDB and appends `tls=true&tlsCAFile=/certs/global-bundle.pem` to the
|
|
connection string.
|
|
|
|
## Related
|
|
|
|
- [`../amazon-eks-documentdb`](../amazon-eks-documentdb/README.md) — Terraform for EKS + DocumentDB
|
|
- [`../../overlays/documentdb`](../../overlays/documentdb) — Kustomize overlay using DocumentDB
|