Skip to content

Commit 4f56b26

Browse files
JuliaMongoJuliaMongo
authored
(DOCSP-18123) Adding OPA Gatekeeper policy agent library links and section to k8s Operator Prod Notes (#771)
* (DOCSP-18123) Adding OPA Gatekeeper policy agent library links and section to prod notes * (DOCSP-18123) Adding OPA Gatekeeper policy agent library links and section to prod notes * (DOCSP-18123) Adding OPA Gatekeeper policy agent library links and section to prod notes * (DOCSP-18123) Adding OPA Gatekeeper policy agent library links and section to prod notes * Address copy review but partially. Waiting for input from Priyo * Address copy review but partially. Waiting for input from Priyo * Address copy review but partially. Waiting for input from Priyo * Address copy review but partially. Waiting for input from Priyo * Address copy review but partially. Waiting for input from Priyo * Address copy review but partially. Waiting for input from Priyo * Include copy and tech review * Last comments, ready for merge, but waiting for a possible example from Priyo * Fix one link
1 parent d2dc9a0 commit 4f56b26

File tree

2 files changed

+104
-8
lines changed

2 files changed

+104
-8
lines changed

‎conf.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,7 @@
251251
'aws': ('http://docs.aws.amazon.com%s', ''),
252252
'gcp': ('https://cloud.google.com%s', ''),
253253
'q-mdb': ('https://quay.io/mongodb%s', ''),
254+
'gatekeeper': ('https://open-policy-agent.github.io/gatekeeper/website/docs%s', ''),
254255
'qr-mdb': ('https://quay.io/repository/mongodb%s', '')
255256
}
256257

‎source/reference/production-notes.txt

Lines changed: 103 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,109 @@ This page details system configuration recommendations for the
1919

2020
- These recommendations reflect performance testing findings and represent
2121
our suggestions for production deployments. We ran the tests on a cluster
22-
comprised of seven AWS EC2 instances of type ``t2.2xlarge`` and a master node of
23-
type ``t2.medium``.
24-
25-
- The recommendations in this section do not take into account individual
26-
characteristics of any deployment. Numerous factors might make your
27-
deployment's characteristics differ from the assumptions made to
28-
create these recommendations. Contact MongoDB support for further
29-
assistance with sizings.
22+
comprised of seven AWS EC2 instances of type ``t2.2xlarge`` and a
23+
master node of type ``t2.medium``.
24+
25+
- The recommendations in this section don't discuss characteristics of
26+
any specific deployment. Your deployment's characteristics may differ
27+
from the assumptions made to create these recommendations. Contact
28+
MongoDB Support for further help with sizings.
29+
30+
31+
Control Your Deployments with Policies Set in OPA Gatekeeper
32+
-----------------------------------------------------------
33+
34+
To control, audit, and debug your production deployments, you can use policies
35+
for the `Gatekeeper <https://github.com/open-policy-agent/gatekeeper>`__
36+
Open Policy Agent (OPA). Gatekeeper contains |k8s-crds| for creating and extending
37+
deployment constraints through the
38+
:gatekeeper:`constraint templates </constrainttemplates/>`.
39+
40+
The |k8s-op-short| offers a :ref:`list of Gatekeeper policies <gatekeeper-policies-list>`
41+
that you can customize and apply to your deployments.
42+
43+
Each Gatekeeper policy consists of:
44+
45+
- ``<policy_name>.yaml`` file
46+
- ``constraints.yaml`` file that is based on the :gatekeeper:`constraint template </constrainttemplates/>`
47+
48+
You can use binary and configurable Gatekeeper policies:
49+
50+
- Binary policies allow or prevent specific configurations, such as
51+
preventing deployments that don't use TLS, or deploying only specific
52+
MongoDB or |onprem| versions.
53+
54+
- Configurable policies allow you to specify configurations, such as the
55+
total number of replica sets that will be deployed for a specific
56+
MongoDB or |onprem| custom resource.
57+
58+
To use and apply Gatekeeper sample policies with the |k8s-op-short|:
59+
60+
1. :gatekeeper:`Install the OPA Gatekeeper </install/>` on your Kubernetes cluster.
61+
62+
2. Review the list of available constraint templates and constraints:
63+
64+
.. code-block:: sh
65+
66+
kubectl get constrainttemplates
67+
kubectl get constraints
68+
69+
3. Navigate to the policy directory, select a policy from the list and
70+
apply it and its constraints file:
71+
72+
.. code-block:: sh
73+
74+
cd <policy_directory>
75+
kubectl apply -f <policy_name>.yaml
76+
kubectl apply -f constraints.yaml
77+
78+
4. Review the Gatekeeper policies that are currently applied:
79+
80+
.. code-block:: sh
81+
82+
kubectl get constrainttemplates
83+
kubectl get contstraints
84+
85+
.. _gatekeeper-policies-list:
86+
87+
List of Sample OPA Gatekeeper Policies
88+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
89+
90+
The |k8s-op-short| offers the following sample policies in this
91+
:github:`OPA examples </mongodb/mongodb-enterprise-kubernetes/tree/master/opa_examples>`
92+
GitHub directory:
93+
94+
.. list-table::
95+
:widths: 40 60
96+
:header-rows: 1
97+
98+
* - Location
99+
- Policy Description
100+
101+
* - :github:`Debugging </mongodb/mongodb-enterprise-kubernetes/tree/master/opa_examples/debugging>`
102+
- Blocks all MongoDB and |onprem| resources. This allows you to use
103+
the log output to craft your own policies. To learn more, see
104+
:gatekeeper:`Gatekeeper Debugging </debug/>`.
105+
106+
* - :github:`mongodb_allow_replicaset </mongodb/mongodb-enterprise-kubernetes/tree/master/opa_examples/mongodb_allow_replicaset>`
107+
- Allows deploying only replica sets for MongoDB resources and
108+
prevents deploying sharded clusters.
109+
110+
* - :github:`mongodb_allowed_versions </mongodb/mongodb-enterprise-kubernetes/tree/master/opa_examples/mongodb_allowed_versions>`
111+
- Allows deploying only specific MongoDB versions.
112+
113+
* - :github:`ops_manager_allowed_versions </mongodb-enterprise-kubernetes/tree/master/opa_examples/ops_manager_allowed_versions>`
114+
- Allows deploying only specific |onprem| versions.
115+
116+
* - :github:`mongodb_strict_tls </10gen/mongodb-enterprise-kubernetes/tree/master/opa_examples/mongodb_strict_tls>`
117+
- Allows using strict TLS mode for MongoDB deployments.
118+
119+
* - :github:`ops_manager_replica_members </10gen/mongodb-enterprise-kubernetes/tree/master/opa_examples/ops_manager_replica_members>`
120+
- Allows deploying a specified number of |onprem| replica set and
121+
Application Database members.
122+
123+
* - :github:`ops_manager_wizardless </10gen/mongodb-enterprise-kubernetes/tree/master/opa_examples/ops_manager_wizardless>`
124+
- Allows installing |onprem| in a non-interactive mode.
30125

31126
Deploy the Recommended Number of MongoDB Replica Sets
32127
-----------------------------------------------------

0 commit comments

Comments
 (0)