austbot/mongo-k8s-sidecar

Mongo Kubernetes副本集Sidecar镜像

镜像概述

本镜像作为Kubernetes环境中MongoDB副本集的辅助工具，旨在实现副本集的自动初始化、动态扩缩容及状态维护，提升MongoDB集群在K8s中的高可用性与可运维性。

核心功能

1. 自动初始化MongoDB副本集
2. 监测K8s Pod变化，动态调整副本集成员
3. 支持StatefulSet稳定网络ID（基于DNS的节点标识）
4. 兼容MongoDB认证与SSL加密配置
5. 可配置的健康检查与重试机制

使用场景

• K8s集群中部署高可用MongoDB副本集
• 需要自动扩缩容的MongoDB生产环境
• 对MongoDB节点标识稳定性有要求的场景（如StatefulSet部署）

配置说明

以下是镜像支持的环境变量配置：

部署示例

StatefulSet与Sidecar配置示例

yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongo-prod
spec:
  serviceName: mongodb
  replicas: 3
  selector:
    matchLabels:
      role: mongo
      environment: prod
  template:
    metadata:
      labels:
        role: mongo
        environment: prod
    spec:
      containers:
      - name: mongo
        image: mongo
        command: ["mongod", "--replSet", "heroku", "--smallfiles", "--noprealloc"]
        volumeMounts:
          - name: mongo-persistent-storage
            mountPath: /data/db
      - name: mongo-sidecar
        image: austbot/mongo-k8s-sidecar
        env:
          - name: MONGO_SIDECAR_POD_LABELS
            value: "role=mongo,environment=prod"
          - name: KUBERNETES_MONGO_SERVICE_NAME
            value: "mongodb"
  volumeClaimTemplates:
  - metadata:
      name: mongo-persistent-storage
    spec:
      accessModes: ["ReadWriteOnce"]
      resources:
        requests:
          storage: 10Gi
---
apiVersion: v1
kind: Service
metadata:
  name: mongodb
spec:
  clusterIP: None
  selector:
    role: mongo
    environment: prod
  ports:
  - port: 27017
    targetPort: 27017

SSL配置示例

生成SSL证书Secret

bash
# 使用Makefile生成证书（需进入examples目录）
export MONGO_SECRET_NAME=mongo-ssl
export KUBECTL_NAMESPACE=default
cd examples && make generate-certificate

# 手动创建Secret
kubectl create secret generic mongo --from-file=./keys/mongodb.pem

带有SSL的容器配置

yaml
containers:
- name: mongo
  image: mongo
  command:
    - mongod
    - "--replSet"
    - "heroku"
    - "--smallfiles"
    - "--noprealloc"
    - "--sslMode"
    - "requireSSL"
    - "--sslPEMKeyFile"
    - "/data/ssl/mongodb.pem"
    - "--sslAllowConnectionsWithoutCertificates"
    - "--sslAllowInvalidCertificates"
    - "--sslAllowInvalidHostnames"
  volumeMounts:
    - name: mongo-persistent-storage
      mountPath: /data/db
    - name: mongo-ssl
      mountPath: /data/ssl
- name: mongo-sidecar
  image: austbot/mongo-k8s-sidecar
  env:
    - name: MONGO_SIDECAR_POD_LABELS
      value: "role=mongo,environment=prod"
    - name: MONGO_SSL_ENABLED
      value: "true"
volumes:
- name: mongo-ssl
  secret:
    secretName: mongo