Deploy Sharded Cluster with Keyfile Authentication使用密钥文件身份验证部署分片群集

Start each mongod in the config server replica set. 启动配置服务器副本集中的每个mongod。Include the keyFile setting. 包括keyFile设置。The keyFile setting enforces both Internal/Membership Authentication and Role-Based Access Control.keyFile设置强制执行内部/成员身份验证和基于角色的访问控制。

You can specify the mongod settings either via a configuration file or the command line.您可以通过配置文件或命令行指定mongod设置。

Configuration File配置文件

If using a configuration file, set security.keyFile to the keyfile's path, sharding.clusterRole to configsvr, and replication.replSetName to the desired name of the config server replica set.如果使用配置文件，请将security.keyFile设置为密钥文件的路径，将sharding.clusterRole设置为configsvr，将replication.replSetName设置为配置服务器副本集的所需名称。

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: configsvr
replication:
  replSetName: <setname>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line命令行

If using the command line parameters, start the mongod with the --keyFile, --configsvr, and --replSet parameters.如果使用命令行参数，请使用--keyFile、--configsvr和--replSet参数启动mongod。

mongod --keyFile <path-to-keyfile> --configsvr --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Connect to a member of the replica set over the localhost interface.通过本地主机接口连接到副本集的成员。

Connect mongosh to one of the mongod instances over the localhost interface. 通过localhost接口将mongosh连接到其中一个mongod实例。You must run mongosh on the same physical machine as the mongod instance.您必须在与mongod实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. localhost接口仅可用，因为尚未为部署创建用户。The localhost interface closes after the creation of the first user.localhost接口在创建第一个用户后关闭。

The rs.initiate() method initiates the replica set and can take an optional replica set configuration document. rs.initiate()方法启动副本集，并可以获取可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id. _id。The _id must match the --replSet parameter passed to the mongod._id必须与传递给mongod的--replSet参数匹配。
• The members field. members字段。The members field is an array and requires a document per each member of the replica set.members字段是一个数组，每个副本集成员都需要一个文档。
• The configsvr field. configsvr字段。The configsvr field must be set to true for the config server replica set.对于配置服务器副本集，configsvr字段必须设置为true。

See Replica Set Configuration for more information on replica set configuration documents.有关副本集配置文档的更多信息，请参阅副本集配置。

Initiate the replica set using the rs.initiate() method and a configuration document:使用rs.initiate()方法和配置文档启动副本集：

rs.initiate(
  {
    _id: "myReplSet",
    configsvr: true,
    members: [
      { _id : 0, host : "cfg1.example.net:27019" },
      { _id : 1, host : "cfg2.example.net:27019" },
      { _id : 2, host : "cfg3.example.net:27019" }
    ]
  }
)

Start each member of the replica set with access control enabled.在启用访问控制的情况下启动副本集的每个成员。

Running a mongod with the keyFile parameter enforces both Internal/Membership Authentication and Role-Based Access Control.使用keyFile参数运行mongod会强制执行内部/成员身份验证和基于角色的访问控制。

Start each mongod in the replica set using either a configuration file or the command line.使用配置文件或命令行启动副本集中的每个mongod。

Configuration File配置文件

If using a configuration file, set the security.keyFile option to the keyfile's path, the replication.replSetName to the desired name of the replica set, and the sharding.clusterRole option to shardsvr.如果使用配置文件，请将security.keyFile选项设置为密钥文件的路径，将replication.replSetName设置为所需的副本集名称，将sharding.clusterRole选项设置为shardsvr。

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: shardsvr
replication:
  replSetName: <replSetName>
storage:
   dbPath: <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line命令行

If using the command line option, when starting the component, specify the --keyFile, replSet, and --shardsvr parameters, as in the following example:如果使用命令行选项，在启动组件时，请指定--keyFile、replSet和--shardsvr参数，如下例所示：

mongod --keyFile <path-to-keyfile> --shardsvr --replSet <replSetName>  --dbpath <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Connect to a member of the replica set over the localhost interface.通过本地主机接口连接到副本集的成员。

Connect mongosh to one of the mongod instances over the localhost interface. 通过localhost接口将mongosh连接到其中一个mongod实例。You must run mongosh on the same physical machine as the mongod instance.您必须在与mongod实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. localhost接口仅可用，因为尚未为部署创建用户。The localhost interface closes after the creation of the first user.localhost接口在创建第一个用户后关闭。

Initiate the replica set.启动复制集。

From mongosh, run the rs.initiate() method.从mongosh运行rs.initiate()方法。

rs.initiate() can take an optional replica set configuration document. 可以使用可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id field set to the replica set name specified in either the replication.replSetName or the --replSet option._id字段设置为replication.replSetName或--replSet选项中指定的副本集名称。
• The members array with a document per each member of the replica set.members数组中的每个副本集成员都有一个文档。

The following example initates a three member replica set.下面的示例初始化一个三成员副本集。

rs.initiate(
  {
    _id : "myReplSet",
    members: [
      { _id : 0, host : "s1-mongo1.example.net:27018" },
      { _id : 1, host : "s1-mongo2.example.net:27018" },
      { _id : 2, host : "s1-mongo3.example.net:27018" }
    ]
  }
)

rs.initiate() triggers an election and elects one of the members to be the primary.rs.initiate()触发一次选举，并选择其中一名成员作为主要成员。

Connect to the primary before continuing. 继续之前，请连接到主服务器。Use rs.status() to locate the primary member.使用rs.status()查找主成员。

Create the shard-local user administrator (optional).创建分片本地用户管理员（可选）。

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

You must be connected to the primary to create users.您必须连接到primary才能创建用户。

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.下面的示例在admin数据库上创建具有userAdminAnyDatabase角色的用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enter the password when prompted. 出现提示时输入密码。See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参阅数据库用户角色。

Authenticate as the shard-local user administrator (optional).以分片本地用户管理员身份进行身份验证（可选）。

Authenticate to the admin database.对admin数据库进行身份验证。

In mongosh, use db.auth() to authenticate. 在mongosh中，使用db.auth()进行身份验证。For example, the following authenticate as the user administrator fred:例如，以下用户作为用户管理员fred进行身份验证：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Alternatively, connect a new mongosh instance to the primary replica set member using the -u <username>, -p <password>, and the --authenticationDatabase parameters.或者，使用-u <username>、-p <password>和--authenticationDatabase参数将新的mongosh实例连接到主副本集成员。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果没有为-p命令行选项指定密码，mongosh会提示输入密码。

Create the shard-local cluster administrator (optional).创建分片本地集群管理员（可选）。

The shard-local cluster administrator user has the clusterAdmin role, which provides privileges that allow access to replication operations.shard本地集群管理员用户具有clusterAdmin角色，该角色提供允许访问复制操作的权限。

For a full list of roles related to replica set operations see Cluster Administration Roles.有关与副本集操作相关的角色的完整列表，请参阅群集管理角色。

Create a cluster administrator user and assign the clusterAdmin role in the admin database:创建群集管理员用户，并在admin数据库中分配clusterAdmin角色：

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),
     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

Enter the password when prompted.出现提示时输入密码。

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Connect a mongos to the cluster将mongos连接到集群

Start a mongos specifying the keyfile using either a configuration file or a command line parameter.使用配置文件或命令行参数启动指定密钥文件的mongos。

Configuration File配置文件

If using a configuration file, set the security.keyFile to the keyfile's path and the sharding.configDB to the replica set name and at least one member of the replica set in <replSetName>/<host:port> format.如果使用配置文件，请将security.keyFile设置为密钥文件的路径，将sharding.configDB设置为副本集名称，并至少将副本集的一个成员设置为<replSetName>/<host:port>格式。

security:
  keyFile: <path-to-keyfile>
sharding:
  configDB: <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Start the mongos specifying the --config option and the path to the configuration file.启动mongos，指定--config选项和配置文件的路径。

mongos --config <path-to-config>

Command Line命令行

If using command line parameters start the mongos and specify the --keyFile and --configdb parameters.如果使用命令行参数，则启动mongos并指定--keyFile和--configdb参数。

mongos --keyFile <path-to-keyfile> --configdb <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Connect to a mongos over the localhost interface.通过本地主机接口连接到mongos。

Connect mongosh to one of the mongos instances over the localhost interface. 通过localhost接口将mongosh连接到其中一个mongos实例。You must run mongosh on the same physical machine as the mongos instance.您必须在与mongos实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. localhost接口仅可用，因为尚未为部署创建用户。The localhost interface closes after the creation of the first user.localhost接口在创建第一个用户后关闭。

Create the user administrator.创建用户管理员。

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在管理数据库上至少应具有userAdminAnyDatabase角色。

The following example creates the user fred on the admin database:以下示例在admin数据库上创建用户fred：

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd:  passwordPrompt(),
     // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参阅数据库用户角色。

Authenticate as the user administrator.以用户管理员身份进行身份验证。

Use db.auth() to authenticate as the user administrator to create additional users:

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Enter the password when prompted.出现提示时输入密码。

Alternatively, connect a new mongosh session to the target replica set member using the -u <username>, -p <password>, and the --authenticationDatabase "admin" parameters. 或者，使用-u <username>、-p <password>和--authenticationDatabase "admin"参数将新的mongosh会话连接到目标副本集成员。You must use the Localhost Exception to connect to the mongos.必须使用Localhost Exception连接到mongos。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果没有为-p命令行选项指定密码，mongosh会提示输入密码。

Create Administrative User for Cluster Management为群集管理创建管理用户

The cluster administrator user has the clusterAdmin role, which grants access to replication and sharding operations.群集管理员用户具有clusterAdmin角色，该角色授予复制和分片操作的访问权限。

Create a clusterAdmin user in the admin database.在admin数据库中创建clusterAdmin用户。

The following example creates the user ravi on the admin database.下面的示例在admin数据库上创建用户ravi。

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),
     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Create additional users (Optional).创建其他用户（可选）。

Create users to allow clients to connect and access the sharded cluster. 创建用户以允许客户端连接和访问分片集群。See Database User Roles for available built-in roles, such as read and readWrite. 有关可用的内置角色（如read and readWrite），请参阅数据库用户角色。You may also want additional administrative users. 您可能还需要其他管理用户。For more information on users, see Users.有关用户的详细信息，请参阅用户。

To create additional users, you must authenticate as a user with userAdminAnyDatabase or userAdmin roles.要创建其他用户，您必须以userAdminAnyDatabase或userAdmin角色的用户身份进行身份验证。