Database Manual / Self-Managed Deployments / Security / Authentication / Internal

Rotate Keys for Self-Managed Sharded Clusters旋转自我管理分片集群的键

Sharded cluster members can use keyfiles to authenticate each other as memers of the same deployment.分片集群成员可以使用键文件作为同一部署的模因进行身份验证。

A keyfile can contain multiple keys and membership authentication is established if at least one key is common across members. This allows for rolling upgrade of the keys without downtime.一个键文件可以包含多个键，如果成员之间至少有一个键是通用的，则建立成员身份验证。这允许在不停机的情况下滚动升级键。

The following tutorial steps through the process to update, without any downtime, the key for a sharded cluster. 以下教程将逐步介绍如何在不停机的情况下更新分片集群的键。[1]

Warning

The example keys in this tutorial are for illustrative purposes only. Do NOT use for your deployement. Instead, generate a keyfile using any method you choose (e.g. openssl rand -base64 756, etc.).本教程中的示例键仅用于说明目的。请勿用于部署。相反，使用您选择的任何方法（例如openssl rand-base64 756等）生成键文件。

Consider a sharded cluster where each member's keyfile contains the following key:考虑一个分片集群，其中每个成员的键文件包含以下键：

Image of current key to replace.

The following procedure updates the sharded cluster members to use a new key:以下过程更新分片集群成员以使用新键：

Image of new key.
[1] This tutorial is not applicable to the keyfile used for the MongoDB's encrypted storage engine local key management. 本教程不适用于用于MongoDB加密存储引擎本地键管理的键文件。That keyfile can only contain a single key.该键文件只能包含一个键。

Before You Begin开始之前

Starting in MongoDB 8.0, you can use the directShardOperations role to perform maintenance operations that require you to execute commands directly against a shard.从MongoDB 8.0开始，您可以使用directShardOperations角色执行维护操作，这些操作要求您直接对分片执行命令。

Warning

Running commands using the directShardOperations role can cause your cluster to stop working correctly and may cause data corruption. 使用directShardOperations角色运行命令可能会导致集群停止正常工作，并可能导致数据损坏。Only use the directShardOperations role for maintenance purposes or under the guidance of MongoDB support. 仅将directShardOperations角色用于维护目的或在MongoDB支持的指导下使用。Once you are done performing maintenance operations, stop using the directShardOperations role.完成维护操作后，停止使用directShardOperations角色。

Procedure过程

1. Modify the Keyfile to Include Old and New Keys修改键文件以包含旧键和新键

Modify each member's keyfile to include both the old and new keys.修改每个成员的键文件，使其同时包含旧键和新键。

Warning

The example keys in this tutorial are for illustrative purposes only. Do NOT use for your deployement. Instead, generate a keyfile using any method you choose (e.g. openssl rand -base64 756, etc.).本教程中的示例键仅用于说明目的。请勿用于部署。相反，使用您选择的任何方法（例如openssl rand -base64 756等）生成键文件。

You can specify multiple key strings as a sequence of key strings (optionally enclosed in quotes):您可以将多个键字符串指定为键字符串序列（可选地括在引号中）：

1. Restart Each Member重新启动每个成员

Once all the keyfiles contain both the old and new keys, restart each member one at a time.一旦所有键文件都包含新旧键，请一次重新启动每个成员。

Config Servers配置服务器

For each secondary of the config server replica set (CSRS), connect mongosh to the member and:对于配置服务器副本集（CSRS）的每个辅助服务器，将mongosh连接到成员，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

For the primary, connect mongosh to the member and对于primary，将mongosh连接到成员，然后

  1. Use rs.stepDown() to step down the member:使用rs.stepDown()来降低成员的级别：

    rs.stepDown()

  2. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  3. Restart the member.重新启动成员。

Shard Replica Sets分片复制集

For each secondary member of the shard replica sets, connect mongosh to the member and:对于分片副本集的每个次要成员，将mongosh连接到该成员，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

For the primary of each shard replica set, connect mongosh to the member and对于每个分片副本集的主分片，将mongosh连接到成员，然后

  1. Use rs.stepDown() to step down the member:使用rs.stepDown()来降低成员的级别：

    rs.stepDown()

  2. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  3. Restart the member.重新启动成员。

mongos Routers

For each mongos/router instance, connect mongosh to the mongos instance and:对于每个mongos/router实例，将mongosh连接到mongos实例，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

Once all members have been restarted, the members now accept either the old or new key for membership authentication.重新启动所有成员后，成员现在接受旧键或新键进行成员身份验证。

3. Update Keyfile Content to the New Key Only仅将键文件内容更新为新键

Warning

The example keys in this tutorial are for illustrative purposes only. Do NOT use for your deployement. Instead, generate a keyfile using any method you choose (e.g. openssl rand -base64 756, etc.).本教程中的示例键仅用于说明目的。请勿用于部署。相反，使用您选择的任何方法（例如openssl rand-base64 756等）生成键文件。

Modify each member's keyfile to include only the new password.修改每个成员的键文件，使其仅包含新密码。

Once all the keyfiles contain the new key only, restart each member one at a time.一旦所有键文件仅包含新键，请一次重新启动每个成员。

Config Servers配置服务器

For each secondary of the config server replica set (CSRS), connect mongosh to the member and:对于配置服务器副本集（CSRS）的每个辅助服务器，将mongosh连接到成员，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

For the primary, connect mongosh to the member and对于primary，将mongosh连接到成员，然后

  1. Use rs.stepDown() to step down the member:使用rs.stepDown()来降低成员的级别：

    rs.stepDown()

  2. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  3. Restart the member.重新启动成员。

Shard Replica Sets分片复制集

For each secondary member of the shard replica sets, connect mongosh to the member and:对于分片副本集的每个次要成员，将mongosh连接到该成员，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

For the primary of each shard replica set, connect mongosh to the member and对于每个分片副本集的主分片，将mongosh连接到成员，然后

  1. Use rs.stepDown() to step down the member:使用rs.stepDown()来降低成员的级别：

    rs.stepDown()

  2. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  3. Restart the member.重新启动成员。

mongos Routers

For each mongos/router instance, connect mongosh to the mongos instance and:对于每个mongos/router实例，将mongosh连接到mongos实例，然后：

  1. Use the db.shutdownServer() method to shut down the member:使用db.shutdownServer()方法关闭成员：

    use admin
    db.shutdownServer()
  2. Restart the member.重新启动成员。

Once all members have been restarted, the members now accept only the new key for membership authentication.一旦所有成员都重新启动，成员现在只接受新的键进行成员身份验证。