Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
13a611b
tls
Aug 13, 2025
5acec1d
tls
Aug 18, 2025
00c9526
add instruction
Aug 27, 2025
ed77baf
clean up
Aug 27, 2025
1335f35
clean up
Aug 27, 2025
33ce9aa
Merge branch 'main' of https://github.com/microsoft/documentdb-kubern…
Sep 26, 2025
cdae47e
use TLSConfiguration
Sep 26, 2025
5b2ad43
address comments
Sep 30, 2025
3aacb40
Merge branch 'microsoft:main' into main
guanzhousongmicrosoft Oct 6, 2025
8bbbe03
rename gateway_tls_controller
Oct 13, 2025
c2df3a2
remove
Oct 13, 2025
9ed222e
fix db.microsoft.com
guanzhousongmicrosoft Oct 13, 2025
6c212c0
add tls argument
guanzhousongmicrosoft Oct 13, 2025
bcd268e
add retry logic
guanzhousongmicrosoft Oct 14, 2025
3c5c58d
fix helm chart
guanzhousongmicrosoft Oct 15, 2025
2b189c3
fix helm chart
guanzhousongmicrosoft Oct 15, 2025
25e6d2f
Merge branch 'main' of https://github.com/guanzhousongmicrosoft/docum…
guanzhousongmicrosoft Oct 15, 2025
7dfb904
chart
guanzhousongmicrosoft Oct 15, 2025
333667d
skip
guanzhousongmicrosoft Oct 15, 2025
b2b1fe6
skip image build
guanzhousongmicrosoft Oct 15, 2025
f3d91a0
skip image build
guanzhousongmicrosoft Oct 15, 2025
4b4989f
skip
guanzhousongmicrosoft Oct 15, 2025
10b9c30
skip test temporary
guanzhousongmicrosoft Oct 15, 2025
048ad33
skip test
guanzhousongmicrosoft Oct 15, 2025
417e430
testing
guanzhousongmicrosoft Oct 15, 2025
b99b71a
Merge branch 'main' of https://github.com/microsoft/documentdb-kubern…
guanzhousongmicrosoft Oct 17, 2025
a896d57
fix
guanzhousongmicrosoft Oct 17, 2025
5111bf8
release workflow
guanzhousongmicrosoft Oct 17, 2025
c882f82
changes
guanzhousongmicrosoft Oct 17, 2025
0cb7d90
modify the scripts
guanzhousongmicrosoft Oct 20, 2025
aa5cde8
add e2e test script
guanzhousongmicrosoft Oct 20, 2025
9cf5318
Merge branch 'main' of https://github.com/microsoft/documentdb-kubern…
guanzhousongmicrosoft Nov 3, 2025
c52d788
Merge branch 'main' of https://github.com/microsoft/documentdb-kubern…
guanzhousongmicrosoft Nov 4, 2025
7abb9dd
refactor
guanzhousongmicrosoft Nov 4, 2025
baf648c
update docs
guanzhousongmicrosoft Nov 4, 2025
138491f
Merge branch 'main' of https://github.com/microsoft/documentdb-kubern…
guanzhousongmicrosoft Nov 5, 2025
823496a
update and clean up
guanzhousongmicrosoft Nov 5, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/build_images.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ on:
manifest_tag:
description: 'Tag for the Docker manifest'
required: false
skip_optional_images:
type: boolean
description: 'Skip building documentdb and gateway images'
required: false
default: false

push:
branches:
Expand Down Expand Up @@ -53,8 +58,10 @@ jobs:
- name: Checkout code
uses: actions/checkout@v4
- name: Login to GHCR
if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.skip_optional_images == 'true' && (matrix.image.name == 'documentdb' || matrix.image.name == 'gateway')) }}
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
- name: Build and Push ${{ matrix.arch }} Image
if: ${{ !(github.event_name == 'workflow_dispatch' && github.event.inputs.skip_optional_images == 'true' && (matrix.image.name == 'documentdb' || matrix.image.name == 'gateway')) }}
run: |
TAG=${{ env.IMAGE_TAG }}-${{ matrix.arch }}
docker build \
Expand Down
18 changes: 14 additions & 4 deletions .github/workflows/release_images.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ on:
chart_version:
description: 'Helm chart version to publish'
required: false
default: '0.1.0'
default: '0.1.1'

permissions:
contents: read
Expand All @@ -31,15 +31,15 @@ jobs:
# Optional test jobs - run both E2E and integration tests in parallel if enabled
test-e2e:
name: E2E Test Images Before Release
if: ${{ inputs.run_tests == true }}
if: ${{ inputs.run_tests == 'true' }}
uses: ./.github/workflows/test-E2E.yml
with:
image_tag: ${{ inputs.image_tag }}
secrets: inherit

test-integration:
name: Integration Test Images Before Release
if: ${{ inputs.run_tests == true }}
if: ${{ inputs.run_tests == 'true' }}
uses: ./.github/workflows/test-integration.yml
with:
image_tag: ${{ inputs.image_tag }}
Expand Down Expand Up @@ -105,11 +105,21 @@ jobs:
run: |
CHART_VERSION_INPUT="${{ github.event.inputs.chart_version }}"
if [[ -z "$CHART_VERSION_INPUT" ]]; then
CHART_VERSION_INPUT="0.1.0"
CHART_VERSION_FROM_FILE=$(awk -F': *' '/^version:/ {print $2; exit}' documentdb-chart/Chart.yaml)
if [[ -z "$CHART_VERSION_FROM_FILE" ]]; then
echo "Failed to determine chart version from documentdb-chart/Chart.yaml" >&2
exit 1
fi
CHART_VERSION_INPUT="$CHART_VERSION_FROM_FILE"
fi
echo "CHART_VERSION=${CHART_VERSION_INPUT}" >> $GITHUB_ENV
echo "Using chart version: ${CHART_VERSION_INPUT}"

- name: Update Chart.yaml metadata
run: |
sed -i "s/^version: .*/version: ${CHART_VERSION}/" documentdb-chart/Chart.yaml
sed -i "s/^appVersion: .*/appVersion: \"${CHART_VERSION}\"/" documentdb-chart/Chart.yaml

- name: Package Helm chart
run: |
helm dependency update operator/documentdb-helm-chart
Expand Down
2 changes: 1 addition & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -406,4 +406,4 @@ charts/
Chart.lock

# Test output
*.out
*.out
2 changes: 1 addition & 1 deletion docs/operator-public-documentation/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,4 +7,4 @@
<body>
<p>If you are not redirected automatically, follow this <a href="preview/">link to preview/index.md</a>.</p>
</body>
</html>
</html>
133 changes: 25 additions & 108 deletions docs/operator-public-documentation/preview/index.md
Original file line number Diff line number Diff line change
@@ -1,123 +1,40 @@
# DocumentDB Kubernetes Operator
# DocumentDB Kubernetes Operator - Version 1

The DocumentDB Kubernetes Operator is an open-source project to run and manage [DocumentDB](https://github.com/microsoft/documentdb) on Kubernetes. `DocumentDB` is the engine powering vCore-based Azure Cosmos DB for MongoDB. It is built on top of PostgreSQL and offers a native implementation of document-oriented NoSQL database, enabling CRUD operations on BSON data types.
Welcome to the DocumentDB Kubernetes Operator documentation for version 1.

As part of a DocumentDB cluster installation, the operator deploys and manages a set of PostgreSQL instance(s), the [DocumentDB Gateway](https://github.com/microsoft/documentdb/tree/main/pg_documentdb_gw), as well as other Kubernetes resources. While PostgreSQL is used as the underlying storage engine, the gateway ensures that you can connect to the DocumentDB cluster using MongoDB-compatible drivers, APIs, and tools.
## Documentation Sections

> **Note:** This project is under active development but not yet recommended for production use. We welcome your feedback and contributions!
### [Advanced Configuration](advanced-configuration/README.md)

## Quickstart
Advanced configuration options for production deployments:

This quickstart guide will walk you through the steps to install the operator, deploy a DocumentDB cluster, access it using `mongosh`, and perform basic operations.
- **[TLS Configuration](advanced-configuration/README.md#tls-configuration)** - Comprehensive TLS setup with three modes (SelfSigned, Provided, CertManager)
- **[High Availability](advanced-configuration/README.md#high-availability)** - Multi-instance and HA configurations
- **[Storage Configuration](advanced-configuration/README.md#storage-configuration)** - Persistent storage and volume management
- **[Resource Management](advanced-configuration/README.md#resource-management)** - CPU and memory optimization
- **[Security](advanced-configuration/README.md#security)** - Network policies, RBAC, and secrets management

### Prerequisites
## Quick Links

- [Helm](https://helm.sh/docs/intro/install/) installed.
- [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/) installed.
- A local Kubernetes cluster such as [minikube](https://minikube.sigs.k8s.io/docs/start/), or [kind](https://kind.sigs.k8s.io/docs/user/quick-start/#installation) installed. You are free to use any other Kubernetes cluster, but that's not a requirement for this quickstart.
- Install [mongosh](https://www.mongodb.com/docs/mongodb-shell/install/) to connect to the DocumentDB cluster.
### Getting Started
- [Installation Guide](https://microsoft.github.io/documentdb-kubernetes-operator/v1/#quickstart)
- [Quick Start](https://microsoft.github.io/documentdb-kubernetes-operator/v1/#quickstart)

### Start a local Kubernetes cluster
### TLS Setup
- [TLS Setup Guide](../../../documentdb-playground/tls/README.md) - Complete TLS configuration guide
- [E2E Testing](../../../documentdb-playground/tls/E2E-TESTING.md) - Comprehensive testing procedures

If you are using `minikube`, use the following command:
### Examples
- [Sample Configurations](../../../operator/src/config/samples/)
- [Deployment Examples](../../../operator/src/scripts/deployment-examples/)

```sh
minikube start
```

If you are using `kind`, use the following command:

```sh
kind create cluster
```

### Install `cert-manager`

[cert-manager](https://cert-manager.io/docs/) is used to manage TLS certificates for the DocumentDB cluster.

> If you already have `cert-manager` installed, you can skip this step.

```sh
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --create-namespace --set installCRDs=true
```

Verify that `cert-manager` is installed correctly:

```sh
kubectl get pods -n cert-manager
```

Output:

```text
NAMESPACE NAME READY STATUS RESTARTS
cert-manager cert-manager-6794b8d569-d7lwd 1/1 Running 0
cert-manager cert-manager-cainjector-7f69cd69f7-pd9bc 1/1 Running 0
cert-manager cert-manager-webhook-6cc5dccc4b-7jmrh 1/1 Running 0
```

### Install `documentdb-operator` using the Helm chart

> The DocumentDB operator utilizes the [CloudNativePG operator](https://cloudnative-pg.io/docs/) behind the scenes, and installs it in the `cnpg-system` namespace. At this point, it is assumed that the CloudNativePG operator is **not** pre-installed in your cluster.

Use the following command to install the DocumentDB operator:

```sh
helm install documentdb-operator oci://ghcr.io/microsoft/documentdb-operator --namespace documentdb-operator --create-namespace
```
## Support

This will install the operator in the `documentdb-operator` namespace. Verify that it is running:
- [GitHub Repository](https://github.com/microsoft/documentdb-kubernetes-operator)
- [Issue Tracker](https://github.com/microsoft/documentdb-kubernetes-operator/issues)
- [Discussions](https://github.com/microsoft/documentdb-kubernetes-operator/discussions)

```sh
kubectl get deployment -n documentdb-operator
```

Output:

```text
NAME READY UP-TO-DATE AVAILABLE AGE
documentdb-operator 1/1 1 1 113s
```

You should also see the DocumentDB operator CRDs installed in the cluster:

```sh
kubectl get crd | grep documentdb
```

Output:

```text
documentdbs.db.microsoft.com
```

### Store DocumentDB credentials in K8s Secret

Before deploying the DocumentDB cluster, create a Kubernetes secret to store the DocumentDB credentials. The sidecar injector plugin will automatically inject these credentials as environment variables into the DocumentDB gateway container.

Create the secret with your desired username and password:

```sh
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
name: documentdb-preview-ns
---
# DocumentDB Credentials Secret
#
# Login credentials:
# Username: k8s_secret_user
# Password: K8sSecret100
#
# Connect using mongosh (port-forward):
# mongosh 127.0.0.1:10260 -u k8s_secret_user -p K8sSecret100 --authenticationMechanism SCRAM-SHA-256 --tls --tlsAllowInvalidCertificates
#
# Connect using connection string (port-forward):
# mongosh "mongodb://k8s_secret_user:K8sSecret100@127.0.0.1:10260/?directConnection=true&authMechanism=SCRAM-SHA-256&tls=true&tlsAllowInvalidCertificates=true&replicaSet=rs0"
#

apiVersion: v1
kind: Secret
Expand Down Expand Up @@ -458,4 +375,4 @@ kubectl delete crd backups.postgresql.cnpg.io \
scheduledbackups.postgresql.cnpg.io \
subscriptions.postgresql.cnpg.io \
documentdbs.db.microsoft.com
```
```
Loading
Loading