bitnamicharts/mongodb-sharded repository overview

⁠MongoDB® Sharded packaged by Bitnami

MongoDB® is an open source NoSQL database that uses JSON for data storage. MongoDB™ Sharded improves scalability and reliability for large datasets by distributing data across multiple machines.

Overview of MongoDB® Sharded⁠

Disclaimer: The respective trademarks mentioned in the offering are owned by the respective companies. We do not provide a commercial license for any of these products. This listing has an open-source license. MongoDB® is run and maintained by MongoDB, which is a completely separate project from Bitnami.

⁠ TL;DR

helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/mongodb-sharded

⁠ Introduction

This chart bootstraps a MongoDB(®) Sharded⁠ deployment on a Kubernetes⁠ cluster using the Helm⁠ package manager.

Classified as a NoSQL database, MongoDB® eschews the traditional table-based relational database structure in favor of JSON-like documents with dynamic schemas, making the integration of data in certain types of applications easier and faster.

This chart uses the sharding method⁠ for distributing data across multiple machines. This is meant for deployments with very large data sets and high throughput operations.

⁠ Before you begin

• Kubernetes 1.23+
• Helm 3.8.0+
• PV provisioner support in the underlying infrastructure
• ReadWriteMany volumes for deployment scaling

⁠ Installing the Chart

To install the chart with the release name my-release:

helm install my-release oci://REGISTRY_NAME/REPOSITORY_NAME/mongodb-sharded

The command deploys MongoDB® on the Kubernetes cluster in the default configuration. The Parameters⁠ section lists the parameters that can be configured during installation.

⁠ Configuration and installation details

This section describes credentials, configuration, and other installation options.

⁠ Resource requests and limits

Bitnami charts allow setting resource requests and limits for all containers inside the chart deployment. These are inside the resources value (check parameter table). Setting requests is essential for production workloads and these should be adapted to your specific use case.

To make this process easier, the chart contains the resourcesPreset values, which automatically sets the resources section according to different presets. Check these presets in the bitnami/common chart⁠. However, in production workloads using resourcesPreset is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the official Kubernetes documentation⁠.

⁠ Update credentials

Bitnami charts configure credentials at first boot. Any further change in the secrets or credentials require manual intervention. Follow these instructions:

• Update the user password following the upstream documentation⁠
• Update the password secret with the new values (replace the SECRET_NAME, ROOT_PASSWORD and REPLICA_SET_KEY placeholders)

kubectl create secret generic SECRET_NAME --from-literal=mongodb-root-password=ROOT_PASSWORD --from-literal=mongodb-replica-set-key=REPLICA_SET_KEY --dry-run -o yaml | kubectl apply -f -

⁠ Prometheus metrics

This chart can be integrated with Prometheus by setting metrics.enabled to true. This will deploy a sidecar container with mongodb_exporter⁠ in all pods. The pods will have the necessary annotations to be automatically scraped by Prometheus.

⁠Prometheus requirements

It is necessary to have a working installation of Prometheus or Prometheus Operator for the integration to work. Install the Bitnami Prometheus helm chart⁠ or the Bitnami Kube Prometheus helm chart⁠ to easily have a working Prometheus in your cluster.

⁠Integration with Prometheus Operator

The chart can deploy PodMonitor objects for integration with Prometheus Operator installations. To do so, set the value metrics.podMonitor.enabled=true. Ensure that the Prometheus Operator CustomResourceDefinitions are installed in the cluster or it will fail with the following error:

no matches for kind "PodMonitor" in version "monitoring.coreos.com/v1"

Install the Bitnami Kube Prometheus helm chart⁠ for having the necessary CRDs and the Prometheus Operator.

⁠ Rolling VS Immutable tags⁠

It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.

Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.

⁠ Change MongoDB® version

To modify the MongoDB® version used in this chart you can specify a valid image tag⁠ using the image.tag parameter. For example, image.tag=X.Y.Z. This approach is also applicable to other images like exporters.

⁠ Sharding

This chart deploys a sharded cluster by default. Some characteristics of this chart are:

• It allows HA by enabling replication on the shards and the config servers. The mongos instances can be scaled horizontally as well.
• The number of secondary and arbiter nodes can be scaled out independently.

⁠ Initialize a fresh instance

The Bitnami MongoDB®⁠ image allows you to use your custom scripts to initialize a fresh instance. You can create a custom config map and give it via initScriptsCM(check options for more details).

The allowed extensions are .sh, and .js.

⁠ Sidecars and Init Containers

If you have a need for additional containers to run within the same pod as Kibana (e.g. an additional metrics or logging exporter), you can do so via the sidecars config parameter (available in the mongos, shardsvr.dataNode, shardsvr.arbiter, configsvr and common sections). Simply define your container according to the Kubernetes container spec.

sidecars:
- name: your-image-name
  image: your-image
  imagePullPolicy: Always
  ports:
  - name: portname
    containerPort: 1234

Similarly, you can add extra init containers using the initContainers parameter.

initContainers:
- name: your-image-name
  image: your-image
  imagePullPolicy: Always
  ports:
  - name: portname
    containerPort: 1234

⁠ Adding extra environment variables

In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the extraEnvVars (available in the mongos, shardsvr.dataNode, shardsvr.arbiter, configsvr and common sections) property.

extraEnvVars:
  - name: MONGODB_VERSION
    value: 4.0

Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the extraEnvVarsCM or the extraEnvVarsSecret values.

⁠ Using an external config server

It is possible to not deploy any shards or a config server. For example, it is possible to simply deploy mongos instances that point to an external MongoDB® sharded database. If that is the case, set the configsvr.external.host and configsvr.external.replicasetName for the mongos instances to connect. For authentication, set the configsvr.external.rootPassword and configsvr.external.replicasetKey values.

⁠ Setting Pod's affinity

This chart allows you to set your custom affinity using the XXX.affinity parameter(s). Find more information about Pod's affinity in the kubernetes documentation⁠.

As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the bitnami/common⁠ chart. To do so, set the XXX.podAffinityPreset, XXX.podAntiAffinityPreset, or XXX.nodeAffinityPreset parameters.

⁠ Backup and restore

To back up and restore Helm chart deployments on Kubernetes, you need to back up the persistent volumes from the source deployment and attach them to a new deployment using Velero⁠, a Kubernetes backup/restore tool. Find the instructions for using Velero in this guide⁠.

⁠ FIPS parameters

The FIPS parameters only have effect if you are using images from the Bitnami Secure Images catalog⁠.

For more information on this new support, please refer to the FIPS Compliance section⁠.

⁠ MCP (Model Context Protocol) Component

This chart includes an optional MCP (Model Context Protocol) component that provides a standardized interface for AI assistants and LLMs to interact with MongoDB. When enabled, it deploys a separate service that exposes MongoDB functionality through the MCP protocol. The upstream project is available at mongodb-js/mongodb-mcp⁠. To enable the MCP component, set mcp.enabled=true:

⁠MCP Configuration

By default (mcp.useRootCredentials=true), the MCP component automatically connects to the MongoDB Sharded cluster via the mongos service using the root credentials. The connection string is passed via the --connectionString argument and points to the mongos router, which is the correct entry point for sharded clusters.

When auth.rootPasswordFilesEnabled=true, the MCP container uses a bash script to read credentials from mounted secret files and then executes the MCP server with exec. This ensures proper signal handling and process management.

When auth.rootPasswordFilesEnabled=false, credentials are passed as environment variables:

• MONGODB_USERNAME: Set to the MongoDB root username
• MONGODB_PASSWORD: Retrieved from the MongoDB root password secret
• MONGODB_DATABASE: Set to "admin" database

If you want to use custom MongoDB credentials instead, set mcp.useRootCredentials=false and provide your own credentials:

mcp:
  enabled: true
  useRootCredentials: false
  extraEnvVars:
    - name: MONGODB_USERNAME
      value: my-custom-user
    - name: MONGODB_PASSWORD
      valueFrom:
        secretKeyRef:
          name: my-mongodb-credentials
          key: password
    - name: MONGODB_DATABASE
      value: mydb
    - name: MONGODB_CONNECTION_STRING
      value: mongodb://my-custom-user:password@mongodb-sharded-service:27017/mydb

The MCP server listens on port 8000 by default and uses HTTP as the transport protocol. By default, the server runs in read-only mode (mcp.readOnly=true), which prevents any write operations to the database.

⁠Authentication and Authorization with kube-rbac-proxy

For enhanced security, you can enable authentication and authorization using a kube-rbac-proxy sidecar:

mcp:
  enabled: true
  auth:
    enabled: true
    allowedServiceAccounts:
      - namespace: default
        name: my-ai-assistant
      - namespace: ai-namespace
        name: another-service

When mcp.auth.enabled is set to true:

• A kube-rbac-proxy sidecar is deployed alongside the MCP container
• The proxy listens on port 8443 (HTTPS) by default and forwards authenticated requests to the MCP server
• RBAC rules are automatically created to allow access to the endpoint
• Only the MCP service account and the service accounts listed in mcp.auth.allowedServiceAccounts can access the endpoint
• The Service will expose the HTTPS port instead of the direct HTTP port

This provides Kubernetes-native authentication and authorization, ensuring that only authorized service accounts can interact with the MCP MongoDB server.

⁠TLS Configuration for kube-rbac-proxy

When authentication is enabled, TLS is always enabled and automatically configured for the kube-rbac-proxy sidecar. By default, the chart will auto-generate a self-signed certificate using Helm capabilities:

mcp:
  enabled: true
  auth:
    enabled: true
    tls:
      autoGenerated:
        enabled: true
        engine: helm  # or cert-manager

You can also provide your own TLS certificate:

mcp:
  enabled: true
  auth:
    enabled: true
    tls:
      autoGenerated:
        enabled: false
      existingSecret: my-tls-secret

Or provide the certificate directly:

mcp:
  enabled: true
  auth:
    enabled: true
    tls:
      autoGenerated:
        enabled: false
      cert: |-
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
      key: |-
        -----BEGIN RSA PRIVATE KEY-----
        ...
        -----END RSA PRIVATE KEY-----

⁠ Persistence

The Bitnami MongoDB®⁠ image stores the MongoDB® data and configurations at the /bitnami/mongodb path of the container.

The chart mounts a Persistent Volume⁠ at this location. The volume is created using dynamic volume provisioning.

⁠ Adjust permissions of persistent volume mountpoint

As the image run as non-root by default, it is necessary to adjust the ownership of the persistent volume so that the container can write data into it.

By default, the chart is configured to use Kubernetes Security Context to automatically change the ownership of the volume. However, this feature does not work in all Kubernetes distributions. As an alternative, this chart supports using an initContainer to change the ownership of the volume before mounting it in the final destination.

You can enable this initContainer by setting volumePermissions.enabled to true.

⁠ Adding extra volumes

The Bitnami Kibana chart supports mounting extra volumes (either PVCs, secrets or configmaps) by using the extraVolumes and extraVolumeMounts properties (available in the mongos, shardsvr.dataNode, shardsvr.arbiter, configsvr and common sections). This can be combined with advanced operations like adding extra init containers and sidecars.

⁠ Parameters

The following subsections list global, common, and component-specific parameters.

⁠ Global parameters

⁠ Common parameters

⁠ MongoDB(®) Sharded parameters

Note: the README for this chart is longer than the DockerHub length limit of 25000, so it has been trimmed. The full README can be found at https://techdocs.broadcom.com/us/en/vmware-tanzu/bitnami-secure-images/bitnami-secure-images/services/bsi-app-doc/apps-charts-mongodb-sharded-index.html⁠