Update Sharded Cluster to Keyfile Authentication将分片群集更新为密钥文件身份验证

Create a keyfile.创建密钥文件。

With keyfile authentication, each mongod or mongos instances in the sharded cluster uses the contents of the keyfile as the shared password for authenticating other members in the deployment. Only mongod or mongos instances with the correct keyfile can join the sharded cluster.

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. 密钥的长度必须介于6到1024个字符之间，并且只能包含base64集合中的字符。All members of the sharded cluster must share at least one common key.分片集群的所有成员必须至少共享一个公共密钥。

You can generate a keyfile using any method you choose. 可以使用所选的任何方法生成密钥文件。For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. It then uses chmod to change file permissions to provide read permissions for the file owner only:

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用密钥文件的其他详细信息和要求，请参阅密钥文件。

Copy the keyfile to each component in the sharded cluster.将密钥文件复制到分片群集中的每个组件。

Every server hosting a mongod or mongos component of the sharded cluster must contain a copy of the keyfile.

Copy the keyfile to each server hosting the sharded cluster members. Ensure that the user running the mongod or mongos instances is the owner of the file and can access the keyfile.

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod or mongos instances, such as a USB drive or a network attached storage device.

Disable the Balancer.禁用平衡器。

Connect mongosh to a mongos.

sh.stopBalancer()

The balancer may not stop immediately if a migration is in progress. 如果正在进行迁移，平衡器可能不会立即停止。The sh.stopBalancer() method blocks the shell until the balancer stops.sh.stopBalancer()方法阻塞shell，直到平衡器停止。

Starting in MongoDB 4.2, sh.stopBalancer() also disables auto-splitting for the sharded cluster.

Use sh.getBalancerState() to verify that the balancer has stopped.

sh.getBalancerState()

See Manage Sharded Cluster Balancer for tutorials on configuring sharded cluster balancer behavior.有关配置分片群集平衡器行为的教程，请参阅管理分片群集均衡器。

Shut down all mongos instances for the sharded cluster.

Connect mongosh to each mongos and shut them down.

Use the db.shutdownServer() method on the admin database to safely shut down the mongos:

db.getSiblingDB("admin").shutdownServer()

Repeat until all mongos instances in the cluster are offline.

Once this step is complete, all mongos instances in the cluster should be offline.

Shut down config server 关闭配置服务器mongod instances.

Connect mongosh to each mongod in the config server deployment and shut them down.

For replica set config server deployments, shut down the primary member last.

Use the db.shutdownServer() method on the admin database to safely shut down the mongod:

db.getSiblingDB("admin").shutdownServer()

Repeat until all config servers are offline.重复此操作，直到所有配置服务器脱机。

Shut down shard replica set mongod instances.关闭分片副本集mongod实例。

For each shard replica set, connect mongosh to each mongod member in the replica set and shut them down. Shut down the primary member last.

Use the db.shutdownServer() method on the admin database to safely shut down the mongod:

db.getSiblingDB("admin").shutdownServer()

Repeat this step for each shard replica set until all mongod instances in all shard replica sets are offline.对每个分片副本集重复此步骤，直到所有分片副本集中的所有mongod实例都脱机。

Once this step is complete, the entire sharded cluster should be offline.一旦这一步骤完成，整个分片集群就应该离线。

Enforce Access Control on the Config Servers.对配置服务器实施访问控制。

Start each mongod in the config server replica set. Include the keyFile setting. The keyFile setting enforces both Internal/Membership Authentication and Role-Based Access Control.

You can specify the mongod settings either via a configuration file or the command line.

Configuration File

If using a configuration file, for a config server replica set, set security.keyFile to the keyfile's path, sharding.clusterRole to configsvr, and replication.replSetName to the name of the config server replica set.

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: configsvr
replication:
  replSetName: <setname>
storage:
   dbpath: <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config>

Command Line

If using the command line parameters, for a config server replica set, start the mongod with the -keyFile, --configsvr, and --replSet parameters.如果使用命令行参数，对于配置服务器副本集，请使用-keyFile、--configsvr和--replSet参数启动mongod。

mongod --keyFile <path-to-keyfile> --configsvr --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

For more information on command line options, see the mongod reference page.有关命令行选项的更多信息，请参阅mongod参考页面。

Make sure to use the original replica set name when restarting each member. 重新启动每个成员时，请确保使用原始副本集名称。You cannot change the name of a replica set.您不能更改副本集的名称。

Enforce Access Control for each Shard in the Sharded Cluster.对分片群集中的每个分片实施访问控制。

Running a mongod with the keyFile parameter enforces both Internal/Membership Authentication and Role-Based Access Control.

Start each mongod in the replica set using either a configuration file or the command line.

Configuration File

If using a configuration file, set the security.keyFile option to the keyfile's path and the replication.replSetName option to the original name of the replica set.

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <setname>
storage:
   dbPath: <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line

If using the command line parameters, start the mongod and specify the --keyFile and --replSet parameters.如果使用命令行参数，请启动mongod并指定--keyFile和--replSet参数。

mongod --keyfile <path-to-keyfile> --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. 包括配置所需的其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. 例如，如果希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。For more information, see Localhost Binding Compatibility Changes.有关详细信息，请参阅本地主机绑定兼容性更改。

For more information on startup parameters, see the mongod reference page.有关启动参数的更多信息，请参阅mongod参考页面。

Make sure to use the original replica set name when restarting each member. You cannot change the name of a replica set.重新启动每个成员时，请确保使用原始副本集名称。您不能更改副本集的名称。

Repeat this step until all shards in the cluster are online.重复此步骤，直到群集中的所有分片都联机。

Create a Shard-Local User Administrator (Optional).创建分片本地用户管理员（可选）。

For each shard replica set in the cluster, connect mongosh to the primary member over the localhost interface. You must run mongosh on the same machine as the target mongod to use the localhost interface.

Create a user with the userAdminAnyDatabase role on the admin database. This user can create additional users for the shard replica set as necessary. Creating this user also closes the Localhost Exception.

The following example creates the shard-local user fred on the admin database.

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(),  // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enforce Access Control for the mongos servers.

Running a mongod with the keyFile parameter enforces both Internal/Membership Authentication and Role-Based Access Control.

Start each mongos in the replica set using either a configuration file or the command line.

Configuration File

If using a configuration file, set the security.keyFile to the keyfile`s path and the sharding.configDB to the replica set name and at least one member of the replica set in <replSetName>/<host:port> format.

security:
  keyFile: <path-to-keyfile>
sharding:
  configDB: <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting. For more information, see Localhost Binding Compatibility Changes.

Start the mongos specifying the --config option and the path to the configuration file.

mongos --config <path-to-config-file>

Command Line

If using command line parameters start the mongos and specify the --keyFile and --configdb parameters.

mongos --keyFile <path-to-keyfile> --configdb <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip. For more information, see Localhost Binding Compatibility Changes.

At this point, the entire sharded cluster is back online and can communicate internally using the keyfile specified. However, external programs like mongosh need to use a correctly provisioned user in order to read or write to the cluster.

Connect to the mongos instance over the localhost interface.

Connect mongosh to one of the mongos instances over the localhost interface. You must run mongosh on the same physical machine as the mongos instance.

The localhost interface is only available since no users have been created for the deployment. The localhost interface closes after the creation of the first user.

Create the user administrator.

Add a user using the db.createUser() method. The user should have at minimum the userAdminAnyDatabase role on the admin database.

The following example creates the user fred on the admin database:

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd:  passwordPrompt(),
     // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

See Database User Roles for a full list of built-in roles and related to database administration operations.

Authenticate as the user administrator.

Use db.auth() to authenticate as the user administrator to create additional users:

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Enter the password when prompted.

Alternatively, connect a new mongosh session to the target replica set member using the -u <username>, -p <password>, and the --authenticationDatabase "admin" parameters. You must use the Localhost Exception to connect to the mongos.

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.

Create Administrative User for Cluster Management

The cluster administrator user has the clusterAdmin role for the sharded cluster and not the shard-local cluster administrator.

The following example creates the user ravi on the admin database.

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),
     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.

Authenticate as cluster admin.

To perform sharding operations, authenticate as a clusterAdmin user with either the db.auth() method or a new mongosh session with the username, password, and authenticationDatabase parameters.

Start the balancer.

Start the balancer.

sh.startBalancer()

Starting in MongoDB 4.2, sh.startBalancer() also enables auto-splitting for the sharded cluster.

Use the sh.getBalancerState() to verify the balancer has started.

See Manage Sharded Cluster Balancer for tutorials on the sharded cluster balancer.

Create additional users (Optional).

Create users to allow clients to connect and access the sharded cluster. See Database User Roles for available built-in roles, such as read and readWrite. You may also want additional administrative users. For more information on users, see Users.

To create additional users, you must authenticate as a user with userAdminAnyDatabase or userAdmin roles.