Kubernetes上MongoDB集群：ServiceAccount实现微服务独立认证方案问询

Great question! This is a really clean approach to abstracting database credentials, and while Kubernetes ServiceAccounts (SA) and RBAC don’t directly integrate with MongoDB out of the box, there are solid ways to bridge the two systems. This lets you avoid manual creation of MongoDB users/databases per microservice and enables automatic credential handling.

Short Answer #

Yes, you can abstract MongoDB authentication by linking Kubernetes' SA/RBAC system to MongoDB's auth mechanisms. The easiest, most maintainable way is to use the official MongoDB Kubernetes Operator, but you can also build custom solutions if needed.

Detailed Breakdown & Options #

Option 1: Use the MongoDB Kubernetes Operator (Recommended) #

The official MongoDB Kubernetes Operator has built-in support for tying Kubernetes identities to MongoDB authentication. Here’s how to implement it:

1. Deploy the Operator: Install the MongoDB Community Operator in your cluster (via Helm or YAML, following standard deployment steps).
2. Enable Kubernetes Authentication for Your Cluster:
   When defining your single-node MongoDB cluster resource, enable the KUBERNETES authentication mode (alongside SCRAM-SHA-256 for admin users). Example YAML:

   apiVersion: mongodbcommunity.mongodb.com/v1
   kind: MongoDBCommunity
   metadata:
     name: my-single-mongo
   spec:
     members: 1
     type: ReplicaSet
     version: "6.0.11"
     security:
       authentication:
         modes: ["SCRAM-SHA-256", "KUBERNETES"]
     users:
       - name: cluster-admin
         db: admin
         passwordSecretRef:
           name: cluster-admin-password
         roles:
           - name: root
             db: admin
   

3. Map ServiceAccounts to MongoDB Roles:
   Create a MongoDBRole resource for each microservice’s ServiceAccount. This ties the SA to a dedicated MongoDB database and its specific permissions. Example for a "payment-service" SA:

   apiVersion: mongodbcommunity.mongodb.com/v1
   kind: MongoDBRole
   metadata:
     name: payment-service-role
   spec:
     mongodbResourceRef:
       name: my-single-mongo
     role:
       name: payment-db-owner
       db: payment_db
     subjects:
       - kind: ServiceAccount
         name: payment-service-sa
         namespace: default
   

4. Microservice Connection:
   Your microservice can authenticate to MongoDB using its default-mounted ServiceAccount token (located at /var/run/secrets/kubernetes.io/serviceaccount/token). The Operator handles validating the token via Kubernetes’ TokenReview API and maps it to the corresponding MongoDB permissions. Most MongoDB drivers support passing this token as the authentication password.

Option 2: Custom Sidecar Container #

If you prefer not to use the Operator, you can build a custom sidecar to automate MongoDB user/database management and credential injection:

• Sidecar Responsibilities:
  • Monitor the pod’s mounted ServiceAccount token.
  • Use the token to authenticate to the Kubernetes API and verify the SA’s identity.
  • Connect to MongoDB with admin credentials, check if a dedicated database/user exists for the SA, and create them if missing.
  • Inject the MongoDB credentials (username/password) into the microservice’s environment variables or a shared volume.
  • Automatically rotate credentials at defined intervals.
• RBAC Setup:
  Grant the sidecar’s ServiceAccount permissions to:
  • Perform TokenReview to validate SA tokens.
  • Access MongoDB with admin-level privileges to manage users and databases.

Option 3: OIDC Authentication with Kubernetes as Identity Provider #

MongoDB 5.0+ supports OIDC authentication, and Kubernetes can act as an OIDC issuer. Here’s the high-level flow:

1. Configure MongoDB for OIDC:
   Set up MongoDB to trust your cluster’s API server OIDC endpoint as an identity provider.
2. Map OIDC Identities to MongoDB Roles:
   Create MongoDB roles and map them to Kubernetes ServiceAccount identities via OIDC claims.
3. Microservice Flow:
   The microservice uses its SA token to obtain an OIDC token from Kubernetes, then uses that OIDC token to authenticate to MongoDB.

Key Considerations #

• Least Privilege: Ensure each ServiceAccount only gets the minimal MongoDB permissions it needs (e.g., read/write access to its own database, no cross-database access).
• Credential Rotation: Automate credential rotation to avoid stale, hardcoded secrets—both the Operator and custom sidecar approaches can handle this.
• Audit Trails: Combine Kubernetes audit logs with MongoDB’s audit logs to track who accessed which databases and when.
• Version Compatibility: Double-check that your MongoDB version supports the auth method you choose (e.g., OIDC requires MongoDB 5.0+, Operator’s K8s auth works with 4.4+).

内容的提问来源于stack exchange，提问作者Rajesh Jain