Deploy Self-Managed Replica Set With Keyfile Authentication使用键文件身份验证部署自我管理副本集

Create a keyfile.创建键文件。

With keyfile authentication, each mongod instances in the replica set uses the contents of the keyfile as the shared password for authenticating other members in the deployment. 通过键文件身份验证，副本集中的每个mongod实例都使用键文件的内容作为共享密码，用于对部署中的其他成员进行身份验证。Only mongod instances with the correct keyfile can join the replica set.只有具有正确键文件的mongod实例才能加入副本集。

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. All members of the replica set must share at least one common key.键的长度必须在6到1024个字符之间，并且只能包含base64集合中的字符。副本集的所有成员必须至少共享一个公共键。

You can generate a keyfile using any method you choose. For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. It then uses chmod to change file permissions to provide read permissions for the file owner only:您可以使用您选择的任何方法生成键文件。例如，以下操作使用openssl生成一个复杂的伪随机1024字符串，用作共享密码。然后，它使用chmod更改文件权限，仅为文件所有者提供读取权限：

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用键文件的其他详细信息和要求，请参阅键文件。

Copy the keyfile to each replica set member.将键文件复制到每个副本集成员。

Copy the keyfile to each server hosting the replica set members. Ensure that the user running the mongod instances is the owner of the file and can access the keyfile.将键文件复制到承载副本集成员的每个服务器。确保运行mongod实例的用户是文件的所有者，并且可以访问键文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod instances, such as a USB drive or a network attached storage device.避免将键文件存储在容易与托管mongod实例的硬件断开连接的存储介质上，例如USB驱动器或网络连接的存储设备。

Start each member of the replica set with access control enabled.在启用访问控制的情况下启动副本集的每个成员。

For each member in the replica set, start the mongod with either the security.keyFile configuration file setting or the --keyFile command-line option. 对于副本集中的每个成员，使用security.keyFile配置文件设置或--keyFile命令行选项启动mongod。Running mongod with the --keyFile command-line option or the security.keyFile configuration file setting enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.使用--keyFile命令行选项或security.keyFile配置文件设置运行mongod，可在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <replicaSetName>
net:
   bindIp: localhost,<hostname(s)|ip address(es)>

Start the mongod using the configuration file:使用配置文件启动mongod：

mongod --config <path-to-config-file>

For more information on the configuration file, see configuration options.有关配置文件的更多信息，请参阅配置选项。

mongod --keyFile <path-to-keyfile> --replSet <replicaSetName> --bind_ip localhost,<hostname(s)|ip address(es)>

Connect to a member of the replica set over the localhost interface.通过localhost接口连接到副本集的成员。

Connect mongosh to one of the mongod instances over the localhost interface. 通过localhost接口将mongosh连接到mongod实例之一。You must run mongosh on the same physical machine as the mongod instance.您必须在与mongod实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. 由于没有为部署创建用户，因此只能使用localhost接口。The localhost interface closes after the creation of the first user.创建第一个用户后，localhost接口关闭。

Initiate the replica set.启动副本集。

From mongosh, run the rs.initiate() method.从mongosh运行rs.initiate()方法。

rs.initiate() can take an optional replica set configuration document. 可以采用可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id field set to the replica set name specified in either the replication.replSetName or the --replSet option._id字段设置为replication.replSetName或--replSet选项中指定的副本集名称。
• The members array with a document per each member of the replica set.members数组，每个副本集的成员都有一个文档。

The following example initates a three member replica set.以下示例初始化一个由三个成员组成的副本集。

rs.initiate(
  {
    _id : "myReplSet",
    members: [
      { _id : 0, host : "mongo1.example.net:27017" },
      { _id : 1, host : "mongo2.example.net:27017" },
      { _id : 2, host : "mongo3.example.net:27017" }
    ]
  }
)

rs.initiate() triggers an election and elects one of the members to be the primary.触发选举，并选举其中一名成员为初选。

Connect to the primary before continuing. Use rs.status() to locate the primary member.请先连接到主服务器，然后再继续。使用rs.status()查找主要成员。

Create the user administrator.创建用户管理员。

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

You must be connected to the primary to create users.您必须连接到primary才能创建用户。

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.以下示例在admin数据库上创建了具有userAdminAnyDatabase角色的用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enter the password when prompted. See Database User Roles for a full list of built-in roles related to database administration operations.出现提示时输入密码。有关与数据库管理操作相关的内置角色的完整列表，请参阅数据库用户角色。

Authenticate as the user administrator.以用户管理员身份进行身份验证。

Authenticate to the admin database.对admin数据库进行身份验证。

In mongosh, use db.auth() to authenticate. For example, the following authenticate as the user administrator fred:在mongosh中，使用db.auth()进行身份验证。例如，以下人员以用户管理员fred身份进行身份验证：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Alternatively, connect a new mongosh instance to the primary replica set member using the -u <username>, -p <password>, and the --authenticationDatabase parameters.或者，使用-u <username>、-p <password>和--authenticationDatabase参数将新的mongosh实例连接到主副本集成员。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果不在-p命令行选项中指定密码，mongosh会提示输入密码。

Create the cluster administrator.创建群集管理员。

The clusterAdmin role grants access to replication operations, such as configuring the replica set.clusterAdmin角色授予对复制操作的访问权限，例如配置副本集。

Create a cluster administrator user and assign the clusterAdmin role in the admin database:创建一个集群管理员用户，并在admin数据库中分配clusterAdmin角色：

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

Enter the password when prompted.出现提示时输入密码。

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Create additional users (Optional).创建其他用户（可选）。

Create users to allow clients to connect and interact with the replica set. See Database User Roles for basic built-in roles to use in creating read-only and read-write users.创建用户以允许客户端连接副本集并与之交互。有关创建只读和读写用户时使用的基本内置角色，请参阅数据库用户角色。

You may also want additional administrative users. For more information on users, see Users in Self-Managed Deployments.您可能还需要其他管理用户。有关用户的更多信息，请参阅自我管理部署中的用户。