Update Self-Managed Sharded Cluster to Keyfile Authentication将自我管理的分片集群更新为键文件身份验证

Create a keyfile.创建键文件。

With keyfile authentication, each mongod or mongos instances in the sharded cluster uses the contents of the keyfile as the shared password for authenticating other members in the deployment. 通过键文件身份验证，分片集群中的每个mongod或mongos实例都使用键文件的内容作为共享密码，用于对部署中的其他成员进行身份验证。Only mongod or mongos instances with the correct keyfile can join the sharded cluster.只有具有正确键文件的mongod或mongos实例才能加入分片集群。

A key's length must be between 6 and 1024 characters and may only contain characters in the base64 set. All members of the sharded cluster must share at least one common key.键的长度必须在6到1024个字符之间，并且只能包含base64集合中的字符。分片集群的所有成员必须至少共享一个公共键。

You can generate a keyfile using any method you choose. For example, the following operation uses openssl to generate a complex pseudo-random 1024 character string to use as a shared password. 您可以使用您选择的任何方法生成键文件。例如，以下操作使用openssl生成一个复杂的伪随机1024字符串，用作共享密码。It then uses chmod to change file permissions to provide read permissions for the file owner only:然后，它使用chmod更改文件权限，仅为文件所有者提供读取权限：

openssl rand -base64 756 > <path-to-keyfile>
chmod 400 <path-to-keyfile>

See Keyfiles for additional details and requirements for using keyfiles.有关使用键文件的其他详细信息和要求，请参阅键文件。

Copy the keyfile to each component in the sharded cluster.将键文件复制到分片集群中的每个组件。

Every server hosting a mongod or mongos component of the sharded cluster must contain a copy of the keyfile.托管分片集群的mongod或mongos组件的每台服务器都必须包含键文件的副本。

Copy the keyfile to each server hosting the sharded cluster members. 将键文件复制到托管分片集群成员的每个服务器。Ensure that the user running the mongod or mongos instances is the owner of the file and can access the keyfile.确保运行mongod或mongos实例的用户是文件的所有者，并且可以访问键文件。

Avoid storing the keyfile on storage mediums that can be easily disconnected from the hardware hosting the mongod or mongos instances, such as a USB drive or a network attached storage device.避免将键文件存储在容易与托管mongod或mongos实例的硬件断开连接的存储介质上，例如USB驱动器或网络连接的存储设备。

Disable the Balancer.禁用平衡器。

Connect mongosh to a mongos.把mongosh和mongos联系起来。

sh.stopBalancer()

The balancer may not stop immediately if a migration is in progress. The sh.stopBalancer() method blocks the shell until the balancer stops.如果正在进行迁移，平衡器可能不会立即停止。sh.stopBalancer()方法会阻塞shell，直到平衡器停止。

Starting in MongoDB 6.0.3, automatic chunk splitting is not performed. This is because of balancing policy improvements. Auto-splitting commands still exist, but do not perform an operation.从MongoDB 6.0.3开始，不执行自动块分割。这是因为平衡了政策的改进。自动拆分命令仍然存在，但不执行操作。

In MongoDB versions earlier than 6.0.3, sh.stopBalancer() also disables auto-splitting for the sharded cluster.在早于6.0.3的MongoDB版本中，sh.stopBalancer()还禁用了分片集群的自动拆分。

Use sh.getBalancerState() to verify that the balancer has stopped.使用sh.getBalancerState()验证平衡器是否已停止。

sh.getBalancerState()

See Manage Sharded Cluster Balancer for tutorials on configuring sharded cluster balancer behavior.有关配置分片集群平衡器行为的教程，请参阅管理分片集群均衡器。

Shut down all mongos instances for the sharded cluster.关闭分片集群的所有mongos实例。

Connect mongosh to each mongos and shut them down.将mongosh连接到每个mongos并关闭它们。

Use the db.shutdownServer() method on the admin database to safely shut down the mongos:在admin数据库上使用db.shutdownServer()方法安全关闭mongos：

db.getSiblingDB("admin").shutdownServer()

Repeat until all mongos instances in the cluster are offline.重复此操作，直到集群中的所有mongos实例都脱机。

Once this step is complete, all mongos instances in the cluster should be offline.完成此步骤后，集群中的所有mongos实例都应该脱机。

Shut down config server mongod instances.关闭配置服务器mongod实例。

Connect mongosh to each mongod in the config server deployment and shut them down.将mongosh连接到配置服务器部署中的每个mongod并关闭它们。

For replica set config server deployments, shut down the primary member last.对于副本集配置服务器部署，请最后关闭primary成员。

Use the db.shutdownServer() method on the admin database to safely shut down the mongod:在admin数据库上使用db.shutdownServer()方法安全关闭mongod：

db.getSiblingDB("admin").shutdownServer()

Repeat until all config servers are offline.重复此操作，直到所有配置服务器都脱机。

Shut down shard replica set mongod instances.关闭分片副本集mongod实例。

For each shard replica set, connect mongosh to each mongod member in the replica set and shut them down. 对于每个分片副本集，将mongosh连接到副本集中的每个mongod成员并关闭它们。Shut down the primary member last.最后关闭primary成员。

Use the db.shutdownServer() method on the admin database to safely shut down the mongod:在admin数据库上使用db.shutdownServer()方法安全关闭mongod：

db.getSiblingDB("admin").shutdownServer()

Repeat this step for each shard replica set until all mongod instances in all shard replica sets are offline.对每个分片副本集重复此步骤，直到所有分片副本集中的所有mongod实例都脱机。

Once this step is complete, the entire sharded cluster should be offline.完成此步骤后，整个分片集群应处于脱机状态。

Enforce Access Control on the Config Servers.对配置服务器实施访问控制。

Start each mongod in the config server replica set. 启动配置服务器副本集中的每个mongod。Include the keyFile setting. 包括keyFile设置。The keyFile setting enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.keyFile设置在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

You can specify the mongod settings either via a configuration file or the command line.您可以通过配置文件或命令行指定mongod设置。

Configuration File配置文件

If using a configuration file, for a config server replica set, set security.keyFile to the keyfile's path, sharding.clusterRole to configsvr, and replication.replSetName to the name of the config server replica set.如果使用配置文件，对于配置服务器副本集，请将security.keyFile设置为键文件的路径，将sharding.clusterRole设置为configsvr，并将replication.replSetName设置为配置服务器副本集中的名称。

security:
  keyFile: <path-to-keyfile>
sharding:
  clusterRole: configsvr
replication:
  replSetName: <setname>
storage:
   dbpath: <path>

Include additional options as required for your configuration. 根据配置要求，包括其他选项。For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config>

Command Line命令行

If using the command line parameters, for a config server replica set, start the mongod with the -keyFile, --configsvr, and --replSet parameters.如果使用命令行参数，对于配置服务器副本集，请使用-keyFile、--configsvr和--replSet参数启动mongod。

mongod --keyFile <path-to-keyfile> --configsvr --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

For more information on command line options, see the mongod reference page.有关命令行选项的更多信息，请参阅mongod参考页面。

Make sure to use the original replica set name when restarting each member. You cannot change the name of a replica set.重新启动每个成员时，请确保使用原始副本集名称。您无法更改副本集的名称。

Enforce Access Control for each Shard in the Sharded Cluster.对分片集群中的每个分片实施访问控制。

Running a mongod with the keyFile parameter enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.使用keyFile参数运行mongod会在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

Start each mongod in the replica set using either a configuration file or the command line.使用配置文件或命令行启动副本集中的每个mongod。

Configuration File配置文件

If using a configuration file, set the security.keyFile option to the keyfile's path and the replication.replSetName option to the original name of the replica set.如果使用配置文件，请将security.keyFile选项设置为键文件的路径，将replication.replSetName选项设置为副本集的原始名称。

security:
  keyFile: <path-to-keyfile>
replication:
  replSetName: <setname>
storage:
   dbPath: <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongod specifying the --config option and the path to the configuration file.启动mongod，指定--config选项和配置文件的路径。

mongod --config <path-to-config-file>

Command Line

If using the command line parameters, start the mongod and specify the --keyFile and --replSet parameters.如果使用命令行参数，请启动mongod并指定--keyFile和--replSet参数。

mongod --keyfile <path-to-keyfile> --replSet <setname> --dbpath <path>

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

For more information on startup parameters, see the mongod reference page.有关启动参数的更多信息，请参阅mongod参考页面。

Make sure to use the original replica set name when restarting each member. You cannot change the name of a replica set.重新启动每个成员时，请确保使用原始副本集名称。您无法更改副本集的名称。

Repeat this step until all shards in the cluster are online.重复此步骤，直到集群中的所有分片都联机。

Create a Shard-Local User Administrator (Optional).创建分片本地用户管理员（可选）。

For each shard replica set in the cluster, connect mongosh to the primary member over the localhost interface. 对于集群中的每个分片副本集，通过localhost接口将mongosh连接到主成员。You must run mongosh on the same machine as the target mongod to use the localhost interface.您必须在与目标mongod相同的机器上运行mongosh才能使用localhost接口。

Create a user with the userAdminAnyDatabase role on the admin database. 在admin数据库上创建一个具有userAdminAnyDatabase角色的用户。This user can create additional users for the shard replica set as necessary. 此用户可以根据需要为分片副本集创建其他用户。Creating this user also closes the Localhost Exception in Self-Managed Deployments.创建此用户也会关闭自我管理部署中的Localhost异常。

The following example creates the shard-local user fred on the admin database.以下示例在admin数据库上创建分片本地用户fred。

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd: passwordPrompt(),  // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

Enforce Access Control for the mongos servers.对mongos服务器实施访问控制。

Running a mongod with the keyFile parameter enforces both Self-Managed Internal/Membership Authentication and Role-Based Access Control in Self-Managed Deployments.使用keyFile参数运行mongod会在自我管理部署中强制执行自我管理内部/成员身份验证和基于角色的访问控制。

Start each mongos in the replica set using either a configuration file or the command line.使用配置文件或命令行启动副本集中的每个mongos。

Configuration File配置文件

If using a configuration file, set the security.keyFile to the keyfile`s path and the sharding.configDB to the replica set name and at least one member of the replica set in <replSetName>/<host:port> format.如果使用配置文件，请将security.keyFile设置为键文件的路径，将sharding.configDB设置为副本集名称，并以<replSetName>/<host:port>格式设置副本集的至少一个成员。

security:
  keyFile: <path-to-keyfile>
sharding:
  configDB: <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the net.bindIp setting.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定net.bindIp设置。

Start the mongos specifying the --config option and the path to the configuration file.启动mongos，指定--config选项和配置文件的路径。

mongos --config <path-to-config-file>

Command Line命令行

If using command line parameters start the mongos and specify the --keyFile and --configdb parameters.如果使用命令行参数，请启动mongos并指定--keyFile和--configdb参数。

mongos --keyFile <path-to-keyfile> --configdb <configReplSetName>/cfg1.example.net:27019,cfg2.example.net:27019,...

Include additional options as required for your configuration. For instance, if you wish remote clients to connect to your deployment or your deployment members are run on different hosts, specify the --bind_ip.根据配置要求，包括其他选项。例如，如果您希望远程客户端连接到部署，或者部署成员在不同的主机上运行，请指定--bind_ip。

At this point, the entire sharded cluster is back online and can communicate internally using the keyfile specified. However, external programs like mongosh need to use a correctly provisioned user in order to read or write to the cluster.此时，整个分片集群重新联机，可以使用指定的键文件进行内部通信。但是，像mongosh这样的外部程序需要使用正确配置的用户才能读取或写入集群。

Connect to the mongos instance over the localhost interface.通过localhost接口连接到mongos实例。

Connect mongosh to one of the mongos instances over the localhost interface. 通过localhost接口将mongosh连接到mongos实例之一。You must run mongosh on the same physical machine as the mongos instance.您必须在与mongos实例相同的物理机器上运行mongosh。

The localhost interface is only available since no users have been created for the deployment. 由于没有为部署创建用户，因此只能使用localhost接口。The localhost interface closes after the creation of the first user.创建第一个用户后，localhost接口关闭。

Create the user administrator.

Add a user using the db.createUser() method. 使用db.createUser()方法添加用户。The user should have at minimum the userAdminAnyDatabase role on the admin database.用户在admin数据库上至少应具有userAdminAnyDatabase角色。

The following example creates the user fred on the admin database:以下示例在admin数据库上创建用户fred：

admin = db.getSiblingDB("admin")
admin.createUser(
  {
    user: "fred",
    pwd:  passwordPrompt(),     // or cleartext password
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

See Database User Roles for a full list of built-in roles and related to database administration operations.有关内置角色和与数据库管理操作相关的完整列表，请参阅数据库用户角色。

Authenticate as the user administrator.以用户管理员身份进行身份验证。

Use db.auth() to authenticate as the user administrator to create additional users:使用db.auth()以用户管理员身份进行身份验证，以创建其他用户：

db.getSiblingDB("admin").auth("fred", passwordPrompt()) // or cleartext password

Enter the password when prompted.出现提示时输入密码。

Alternatively, connect a new mongosh session to the target replica set member using the -u <username>, -p <password>, and the --authenticationDatabase "admin" parameters. 或者，使用-u <username>、-p <password>和--authenticationDatabase "admin"参数将新的mongosh会话连接到目标副本集成员。You must use the Localhost Exception in Self-Managed Deployments to connect to the mongos.您必须在自我管理部署中使用Localhost异常来连接到mongos。

mongosh -u "fred" -p  --authenticationDatabase "admin"

If you do not specify the password to the -p command-line option, mongosh prompts for the password.如果不在-p命令行选项中指定密码，mongosh会提示输入密码。

Create Administrative User for Cluster Management创建群集管理的管理用户

The cluster administrator user has the clusterAdmin role for the sharded cluster and not the shard-local cluster administrator.集群管理员用户具有分片集群的clusterAdmin角色，而不是分片本地集群管理员。

The following example creates the user ravi on the admin database.以下示例在admin数据库上创建用户ravi。

db.getSiblingDB("admin").createUser(
  {
    "user" : "ravi",
    "pwd" : passwordPrompt(),     // or cleartext password
    roles: [ { "role" : "clusterAdmin", "db" : "admin" } ]
  }
)

See Cluster Administration Roles for a full list of built-in roles related to replica set and sharded cluster operations.有关与副本集和分片群集操作相关的内置角色的完整列表，请参阅群集管理角色。

Authenticate as cluster admin.以群集管理员身份进行身份验证。

To perform sharding operations, authenticate as a clusterAdmin user with either the db.auth() method or a new mongosh session with the username, password, and authenticationDatabase parameters.要执行分片操作，请使用db.auth()方法或使用username、password和authenticationDatabase参数的新mongosh会话作为clusterAdmin用户进行身份验证。

Start the balancer.启动平衡器。

Start the balancer.启动平衡器。

sh.startBalancer()

Starting in MongoDB 6.0.3, automatic chunk splitting is not performed. This is because of balancing policy improvements. Auto-splitting commands still exist, but do not perform an operation.从MongoDB 6.0.3开始，不执行自动块分割。这是因为平衡了政策的改进。自动拆分命令仍然存在，但不执行操作。

In MongoDB versions earlier than 6.0.3, sh.startBalancer() also enables auto-splitting for the sharded cluster.在早于6.0.3的MongoDB版本中，sh.startBalancer()还启用了分片集群的自动拆分。

Use the sh.getBalancerState() to verify the balancer has started.使用sh.getBalancerState()验证平衡器是否已启动。

See Manage Sharded Cluster Balancer for tutorials on the sharded cluster balancer.有关分片集群平衡器的教程，请参阅管理分片集群均衡器。

Create additional users (Optional).创建其他用户（可选）。

Create users to allow clients to connect and access the sharded cluster. 创建用户以允许客户端连接和访问分片集群。See Database User Roles for available built-in roles, such as read and readWrite. 有关可用的内置角色（如read和readWrite），请参阅数据库用户角色。You may also want additional administrative users. For more information on users, see Users in Self-Managed Deployments.您可能还需要其他管理用户。有关用户的更多信息，请参阅自我管理部署中的用户。

To create additional users, you must authenticate as a user with userAdminAnyDatabase or userAdmin roles.要创建其他用户，您必须以userAdminAnyDatabase或userAdmin角色的用户身份进行身份验证。