You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Create and apply RBAC resources to each cluster.
5
+
content: |
6
+
7
+
Use :github:`these RBAC resource examples </mongodb/mongodb-enterprise-kubernetes/tree/1.20.1/samples/multi-cluster-cli-gitops/resources/rbac>` to create your own. To learn more about these
8
+
RBAC resources, see :ref:`multi-cluster-rbac-manual`.
9
+
10
+
To apply them to your central and member clusters with GitOps, you can use a tool like :argo-cd:`Argo CD </cd>`.
11
+
12
+
---
13
+
stepnum: 2
14
+
ref: create-configmap-gitops
15
+
title: Create and apply the ConfigMap file.
16
+
content: |
17
+
18
+
The |k8s-op-short| keeps track of its member clusters using a |k8s-configmap-def| file. Copy, modify, and apply the following example ConfigMap:
19
+
20
+
.. code-block:: yaml
21
+
22
+
apiVersion: v1
23
+
kind: ConfigMap
24
+
data:
25
+
cluster1: ""
26
+
cluster2: ""
27
+
metadata:
28
+
namespace: <namespace>
29
+
name: mongodb-enterprise-operator-member-list
30
+
labels:
31
+
multi-cluster: "true"
32
+
33
+
---
34
+
stepnum: 3
35
+
ref: configure-kubeconfig-gitops
36
+
title: Configure the ``kubeconfig`` secret for the |k8s-op-short|.
37
+
content: |
38
+
39
+
The |k8s-op-short|, which runs in the central cluster, communicates with the Pods in
40
+
the member clusters through the Kubernetes API. For this to work, the |k8s-op-short|
41
+
needs a :k8sdocs:`kubeconfig </concepts/configuration/organize-cluster-access-kubeconfig/>`
42
+
file that contains the service account tokens of the member clusters. Create this
43
+
``kubeconfig`` file by following these steps:
44
+
45
+
1. Obtain a list of |k8s-service-accounts| configured in the |k8s-op-short|'s namespace. For example, if you chose to use the default ``mongodb`` namespace, then you can obtain the service accounts using the following command:
46
+
47
+
.. code-block:: sh
48
+
49
+
kubectl get serviceaccounts -n mongodb
50
+
51
+
#. Get the secret for each service account that belongs to a member cluster.
52
+
53
+
.. code-block:: sh
54
+
55
+
kubectl get secret <service-account-name> -n mongodb -o yaml
56
+
57
+
#. In each service account secret, copy the |certauth| certificate and token. For example, copy ``<ca_certificate>`` and ``<token>`` from the secret, as shown in the following example:
58
+
59
+
.. code-block:: yaml
60
+
61
+
apiVersion: v1
62
+
kind: Secret
63
+
metadata:
64
+
name: my-service-account
65
+
namespace: mongodb
66
+
data:
67
+
ca.crt: <ca_certificate>
68
+
token: <token>
69
+
70
+
#. Copy the following ``kubeconfig`` example for the central cluster and replace
71
+
the placeholders with the ``<ca_certificate>`` and ``<token>`` you copied from the service account secrets.
72
+
73
+
.. code-block:: yaml
74
+
75
+
apiVersion: v1
76
+
clusters:
77
+
- cluster:
78
+
certificate-authority-data: <cluster-1-ca.crt>
79
+
server: https://:
80
+
name: kind-e2e-cluster-1
81
+
- cluster:
82
+
certificate-authority-data: <cluster-2-ca.crt>
83
+
server: https://:
84
+
name: kind-e2e-cluster-2
85
+
contexts:
86
+
- context:
87
+
cluster: kind-e2e-cluster-1
88
+
namespace: mongodb
89
+
user: kind-e2e-cluster-1
90
+
name: kind-e2e-cluster-1
91
+
- context:
92
+
cluster: kind-e2e-cluster-2
93
+
namespace: mongodb
94
+
user: kind-e2e-cluster-2
95
+
name: kind-e2e-cluster-2
96
+
kind: Config
97
+
users:
98
+
- name: kind-e2e-cluster-1
99
+
user:
100
+
token: <cluster-1-token>
101
+
- name: kind-e2e-cluster-2
102
+
user:
103
+
token: <cluster-2-token>
104
+
105
+
#. Save the ``kubeconfig`` file.
106
+
107
+
#. Create a secret in the central cluster that you mount in the |k8s-op-short| as illustrated in :github:`the reference Helm chart </mongodb/helm-charts/blob/enterprise-operator-1.20.1/charts/enterprise-operator/templates/operator.yaml#L191-L197/>`. For example:
You can choose to create and maintain the resource files needed for the |mongodb-multis| deployment in a GitOps environment.
502
+
503
+
If you use a GitOps workflow, you can't use the :ref:`kubectl mongodb plugin <kubectl-plugin-ref>`, which automatically configures :k8sdocs:`role-based access control (RBAC) </reference/access-authn-authz/rbac>` and creates the :ref:`kubeconfig <multi-cluster-diagram>` file that allows the central cluster to communicate with its member clusters. Instead, you must manually configure or build your own automation for configuring the RBAC and ``kubeconfig`` files based on the procedure and examples in :ref:`multi-cluster-gitops`.
504
+
505
+
The following prerequisite sections describe how to :ref:`install the kubectl MongoDB plugin <install-kubectl-mongodb-plugin>` if you don't use GitOps or :ref:`configure resources for GitOps <multi-cluster-gitops>` if you do.
If you use a GitOps workflow, you won't be able to use the :ref:`kubectl mongodb plugin <kubectl-plugin-ref>` to automatically configure :k8sdocs:`role-based access control (RBAC) </reference/access-authn-authz/rbac>` or the :ref:`kubeconfig <multi-cluster-diagram>` file that allows the central cluster to communicate with its member clusters. Instead, you must manually configure and apply the following resource files or build your own automation based on the information below.
528
+
529
+
.. note::
530
+
531
+
To learn how the |kubectl-mongodb| automates the following steps,
532
+
:github:`view the code </mongodb/mongodb-enterprise-kubernetes/blob/master/tools/multicluster/cmd/common.go#L373-L399>` in GitHub.
533
+
534
+
To configure RBAC and the ``kubeconfig`` for GitOps:
0 commit comments