Deploy Self-Managed Sharded Cluster with Keyfile Authentication部署具有键文件身份验证的自我管理分片集群

Start each mongod in the config server replica set. Include the keyFile setting. 启动配置服务器副本集中的每个mongod。包括keyFile设置。The keyFile setting enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.keyFile设置在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

You can specify the mongod settings either via a configuration file or the command line.您可以通过配置文件或命令行指定mongod设置。

Configuration File配置文件

If using a configuration file, set security.keyFile to the keyfile's path, sharding.clusterRole to configsvr, and replication.replSetName to the desired name of the config server replica set.如果使用配置文件，请将security.keyFile设置为键文件的路径，将sharding.clusterRole设置为configsvr，并将replication.replSetName设置为配置服务器副本集的所需名称。

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: configsvr
replication:
  replSetName: <setname>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line

If using the command line parameters, start the mongod with the --keyFile, --configsvr, and --replSet parameters.如果使用命令行参数，请使用--keyFile、--configsvr和--replSet参数启动mongod。

mongod --keyFile <path-to-keyfile> --configsvr --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

Connect to a member of the replica set over the localhost interface.通过localhost接口连接到副本集的成员。

Connect mongosh to one of the mongod instances over the localhost interface. 通过localhost接口将mongosh连接到mongod实例之一。You must run mongosh on the same physical machine as the mongod instance.您必须在与mongod实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. The localhost interface closes after the creation of the first user.由于没有为部署创建用户，因此只能使用localhost接口。创建第一个用户后，localhost接口关闭。

The rs.initiate() method initiates the replica set and can take an optional replica set configuration document. rs.initiate()方法启动副本集，并可以获取可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id. _id。The _id must match the --replSet parameter passed to the mongod.必须与传递给mongod的--replSet参数匹配。
• The members field. The members field is an array and requires a document per each member of the replica set.members字段。members字段是一个数组，每个副本集的成员都需要一个文档。
• The configsvr field. The configsvr field must be set to true for the config server replica set.configsvr字段。对于配置服务器副本集，configsvr字段必须设置为true。

See Self-Managed Replica Set Configuration for more information on replica set configuration documents.有关副本集配置文档的更多信息，请参阅自我管理副本集配置。

Initiate the replica set using the rs.initiate() method and a configuration document:使用rs.initiate()方法和配置文档启动副本集：

rs.initiate(
  {
    _id: "myReplSet",
    configsvr: true,
    members: [
      { _id : 0, host : "cfg1.example.net:27019" },
      { _id : 1, host : "cfg2.example.net:27019" },
      { _id : 2, host : "cfg3.example.net:27019" }
    ]
  }
)

Start each member of the replica set with access control enabled.在启用访问控制的情况下启动副本集的每个成员。

Running a mongod with the keyFile parameter enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.使用keyFile参数运行mongod会在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

Start each mongod in the replica set using either a configuration file or the command line.使用配置文件或命令行启动副本集中的每个mongod。

Configuration File配置文件

If using a configuration file, set the security.keyFile option to the keyfile's path, the replication.replSetName to the desired name of the replica set, and the sharding.clusterRole option to shardsvr.如果使用配置文件，请将security.keyFile选项设置为键文件的路径，将replication.replSetName设置为副本集的所需名称，将sharding.clusterRole选项设置为shardsvr。

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: shardsvr
replication:
  replSetName: <replSetName>
storage:
   dbPath: <path>

Include additional options as required for your configuration. 根据配置要求，包括其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line

If using the command line option, when starting the component, specify the --keyFile, replSet, and --shardsvr parameters, as in the following example:如果使用命令行选项，在启动组件时，请指定--keyFile、replSet和--shardsvr参数，如下例所示：

mongod --keyFile <path-to-keyfile> --shardsvr --replSet <replSetName>  --dbpath <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

Connect to a member of the replica set over the localhost interface.通过localhost接口连接到副本集的成员。

Connect mongosh to one of the mongod instances over the localhost interface. 通过localhost接口将mongosh连接到mongod实例之一。You must run mongosh on the same physical machine as the mongod instance.您必须在与mongod实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. 由于没有为部署创建用户，因此只能使用localhost接口。The localhost interface closes after the creation of the first user.创建第一个用户后，localhost接口关闭。

Initiate the replica set.启动副本集。

From mongosh, run the rs.initiate() method.从mongosh运行rs.initiate()方法。

rs.initiate() can take an optional replica set configuration document. 可以采用可选的副本集配置文档。In the replica set configuration document, include:在副本集配置文档中，包括：

• The _id field set to the replica set name specified in either the replication.replSetName or the --replSet option._id字段设置为replication.replSetName或--replSet选项中指定的副本集名称。
• The members array with a document per each member of the replica set.members数组，每个副本集的成员都有一个文档。

The following example initates a three member replica set.以下示例初始化一个由三个成员组成的副本集。

rs.initiate(
  {
    _id : "myReplSet",
    members: [
      { _id : 0, host : "s1-mongo1.example.net:27018" },
      { _id : 1, host : "s1-mongo2.example.net:27018" },
      { _id : 2, host : "s1-mongo3.example.net:27018" }
    ]
  }
)

rs.initiate() triggers an election and elects one of the members to be the primary.触发选举，并选举其中一名成员为primary。

Connect to the primary before continuing. Use rs.status() to locate the primary member.请先连接到主服务器，然后再继续。使用rs.status()查找主要成员。

Create the shard-local user administrator (optional).创建分片本地用户管理员（可选）。

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

You must be connected to the primary to create users.您必须连接到primary才能创建用户。

The following example creates the user fred with the userAdminAnyDatabase role on the admin database.以下示例在admin数据库上创建了具有userAdminAnyDatabase角色的用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(), // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enter the password when prompted. 出现提示时输入密码。See Database User Roles for a full list of built-in roles related to database administration operations.有关与数据库管理操作相关的内置角色的完整列表，请参阅数据库用户角色。

Authenticate as the shard-local user administrator (optional).以分片本地用户管理员身份进行身份验证（可选）。

Authenticate to the admin database.对admin数据库进行身份验证。

In mongosh, use db.auth() to authenticate. 在mongosh中，使用db.auth()进行身份验证。For example, the following authenticate as the user administrator fred:例如，以下人员以用户管理员fred身份进行身份验证：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Alternatively, connect a new mongosh instance to the primary replica set member using the -u <username>, -p <password>, and the --authenticationDatabase parameters.或者，使用-u <username>、-p <password>和--authenticationDatabase参数将新的mongosh实例连接到主副本集成员。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果不在-p命令行选项中指定密码，mongosh会提示输入密码。

Create the shard-local cluster administrator (optional).创建分片本地集群管理员（可选）。

The shard-local cluster administrator user has the clusterAdmin role, which provides privileges that allow access to replication operations.分片本地集群管理员用户具有clusterAdmin角色，该角色提供允许访问复制操作的权限。

For a full list of roles related to replica set operations see Cluster Administration Roles.有关与副本集操作相关的角色的完整列表，请参阅群集管理角色。

Create a cluster administrator user and assign the clusterAdmin role in the admin database:创建一个集群管理员用户，并在admin数据库中分配clusterAdmin角色：

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

Enter the password when prompted.出现提示时输入密码。

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Connect a mongos to the cluster将mongos连接到集群

Start a mongos specifying the keyfile using either a configuration file or a command line parameter.启动mongos，使用配置文件或命令行参数指定键文件。

Configuration File配置文件

If using a configuration file, set the security.keyFile to the keyfile's path and the sharding.configDB to the replica set name and at least one member of the replica set in <replSetName>/<host:port> format.如果使用配置文件，请将security.keyFile设置为键文件的路径，将sharding.configDB设置为副本集名称，并以<replSetName>/<host:port>格式设置副本集的至少一个成员。

security:
  keyFile: <path-to-keyfile>
sharding:
  configDB: <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongos specifying the --config option and the path to the configuration file.启动mongos，指定--config选项和配置文件的路径。

mongos --config <path-to-config>

Command Line命令行

If using command line parameters start the mongos and specify the --keyFile and --configdb parameters.如果使用命令行参数，请启动mongos并指定--keyFile和--configdb参数。

mongos --keyFile <path-to-keyfile> --configdb <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

Connect to a mongos over the localhost interface.通过localhost接口连接到mongos。

Connect mongosh to one of the mongos instances over the localhost interface. 通过localhost接口将mongosh连接到mongos实例之一。You must run mongosh on the same physical machine as the mongos instance.您必须在与mongos实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. The localhost interface closes after the creation of the first user.由于没有为部署创建用户，因此只能使用localhost接口。创建第一个用户后，localhost接口关闭。

Create the user administrator.创建用户管理员。

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

The following example creates the user fred on the admin database:以下示例在admin数据库上创建用户fred：

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd:  passwordPrompt(),     // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参阅数据库用户角色。

Authenticate as the user administrator.以用户管理员身份进行身份验证。

Use db.auth() to authenticate as the user administrator to create additional users:使用db.auth()以用户管理员身份进行身份验证，以创建其他用户：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Enter the password when prompted.出现提示时输入密码。

Alternatively, connect a new mongosh session to the target replica set member using the -u <username>, -p <password>, and the --authenticationDatabase "admin" parameters. 或者，使用-u <username>、-p <password>和--authenticationDatabase "admin"参数将新的mongosh会话连接到目标副本集成员。You must use the Localhost Exception in Self-Managed Deployments to connect to the mongos.您必须在自我管理部署中使用Localhost异常来连接到mongos。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果不在-p命令行选项中指定密码，mongosh会提示输入密码。

Create Administrative User for Cluster Management创建群集管理的管理用户

The cluster administrator user has the clusterAdmin role, which grants access to replication and sharding operations.集群管理员用户具有clusterAdmin角色，该角色授予对复制和分片操作的访问权限。

Create a clusterAdmin user in the admin database.在admin数据库中创建clusterAdmin用户。

The following example creates the user ravi on the admin database.以下示例在admin数据库上创建用户ravi。

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Create additional users (Optional).创建其他用户（可选）。

Create users to allow clients to connect and access the sharded cluster. 创建用户以允许客户端连接和访问分片集群。See Database User Roles for available built-in roles, such as read and readWrite. 有关可用的内置角色（如read和readWrite），请参阅数据库用户角色。You may also want additional administrative users. For more information on users, see Users in Self-Managed Deployments.您可能还需要其他管理用户。有关用户的更多信息，请参阅自我管理部署中的用户。

To create additional users, you must authenticate as a user with userAdminAnyDatabase or userAdmin roles.要创建其他用户，您必须以userAdminAnyDatabase或userAdmin角色的用户身份进行身份验证。