4.5.4. Install MongoDB Atlas Applier

4.5.4. Install MongoDB Atlas Applier
Prev	^Up	4.5. Deploying the MongoDB Applier	Next

4.5.4. Install MongoDB Atlas Applier

4.5.4.1. Import MongoDB Atlas Certificates

Note

The steps in this section relate specifically to applying to a MongoDB Atlas Instance. For configuring the applier to work with standatd MongoDB, please refer to the following section: Section 4.5.3, “Install MongoDB Applier”

Installation of the MongoDB replication requires special configuration of the Source and Target hosts so that each is configured for the correct datasource type.

To configure the Applier replicators:

Before installing the applier, the following addition needs adding to the extractor configuration. Apply the following parameters on the extractor host, update the extractor using the details below, and then install the applier
- For Staging installs:
  copy
```
shell> cd tungsten-replicator-7.0.3-141
shell> ./tools/tpm configure alpha \
--enable-heterogeneous-master=true
shell> ./tools/tpm update
```
- For INI installs: Add the following the /etc/tungsten/tungsten.ini
  copy
```
[alpha]
...Existing Replicator Config...
enable-heterogeneous-master=true

shell> tpm update
```
Unpack the Tungsten Replicator distribution in staging directory:
copy
```
shell> tar zxf tungsten-replicator-7.0.3-141.tar.gz
```
Change into the staging directory:
copy
```
shell> cd tungsten-replicator-7.0.3-141
```
Configure the installation using tpm:
Show Staging
Show INI
copy
```
shell> ./tools/tpm configure defaults \
    --reset \
    --install-directory=/opt/continuent \
    --profile-script=~/.bash_profile \
    --disable-security-controls=false \
    --rmi-ssl=false \
    --thl-ssl=false \
    --rmi-authentication=false \
    --rest-api-admin-user=apiuser \
    --rest-api-admin-pass=secret

shell> ./tools/tpm configure alpha \
    --master=sourcehost \
    --members=localhost \
    --datasource-type=mongodb \
    --replication-user=tungsten \
    --replication-password=secret \
    --svc-applier-filters=dropstatementdata \
    --role=slave \
    --replication-host=atlasendpoint.mongodb.net \
    --replication-port=27017 \
    --property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
```
copy
```
shell> vi /etc/tungsten/tungsten.ini
```
copy
```
[defaults]
install-directory=/opt/continuent
profile-script=~/.bash_profile
disable-security-controls=false
rmi-ssl=false
thl-ssl=false
rmi-authentication=false
rest-api-admin-user=apiuser
rest-api-admin-pass=secret

[alpha]
master=sourcehost
members=localhost
datasource-type=mongodb
replication-user=tungsten
replication-password=secret
svc-applier-filters=dropstatementdata
role=slave
replication-host=atlasendpoint.mongodb.net
replication-port=27017
property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
```
Configuration group defaults
The description of each of the options is shown below; click the icon to hide this detail:
Click the icon to show a detailed description of each argument.
- --reset
  reset
  For staging configurations, deletes all pre-existing configuration information between updating with the new configuration values.
- --install-directory=/opt/continuent
  install-directory=/opt/continuent
  Path to the directory where the active deployment will be installed. The configured directory will contain the software, THL and relay log information unless configured otherwise.
- --profile-script=~/.bash_profile
  profile-script=~/.bash_profile
  Append commands to include env.sh in this profile script
- --disable-security-controls=false
  disable-security-controls=false
  Disables all forms of security, including SSL, TLS and authentication
- --rmi-ssl=false
  rmi-ssl=false
  Enable SSL encryption of RMI communication on this host
- --thl-ssl=false
  thl-ssl=false
  Enable SSL encryption of THL communication for this service
- --rmi-authentication=false
  rmi-authentication=false
  Enable RMI authentication for the services running on this host
- --rest-api-admin-user=apiuser
  rest-api-admin-user=apiuser
  Optional: Must be specified along with rest-api-admin-pass if you wish to access the full API features and use the Dashboard GUI for cluster installations.
- --rest-api-admin-pass=secret
  rest-api-admin-pass=secret
  Optional: Must be specified along with rest-api-admin-user if you wish to access the full API features.
Configuration group alpha
The description of each of the options is shown below; click the icon to hide this detail:
Click the icon to show a detailed description of each argument.
- --master=sourcehost
  master=sourcehost
  The hostname of the primary (extractor) within the current service.
- --members=localhost
  members=localhost
  Hostnames for the dataservice members
- --datasource-type=mongodb
  datasource-type=mongodb
  Database type
- --replication-user=tungsten
  replication-user=tungsten
  For databases that required authentication, the username to use when connecting to the database using the corresponding connection method (native, JDBC, etc.).
- --replication-password=secret
  replication-password=secret
  The password to be used when connecting to the database using the corresponding --replication-user.
- --svc-applier-filters=dropstatementdata
  svc-applier-filters=dropstatementdata
  Replication service applier filters
- --role=slave
  role=slave
  What is the replication role for this service?
- --replication-host=atlasendpoint.mongodb.net
  replication-host=atlasendpoint.mongodb.net
  Hostname of the datasource where the database is located. If the specified hostname matches the current host or member name, the database is assumed to be local. If the hostnames do not match, extraction is assumed to be via remote access. For MySQL hosts, this configures a remote replication Replica (relay) connection.
- --replication-port=27017
  replication-port=27017
  The network port used to connect to the database server. The default port used depends on the database being configured.
- --property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
  property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
  The --property option enables you to explicitly set property values in the target files. A number of different models are supported:
  - key=value
    Set the property defined by key to the specified value without evaluating any template values or other rules.
  - key+=value
    Add the value to the property defined by key. Template values and other options append their settings to the end of the specified property.
  - key~=/match/replace/
    Evaluate any template values and other settings, and then perform the specified Ruby regex operation to the property defined by key. For example --property=replicator.key~=/(.*)/somevalue,\1/ will prepend somevalue before the template value for replicator.key.
Note
If you plan to make full use of the REST API (which is enabled by default) you will need to also configure a username and password for API access. This must be done by specifying the following options in your configuration:
```
rest-api-admin-user=tungsten
rest-api-admin-pass=secret
```
Once the prerequisites and configuring of the installation has been completed, the software can be installed:
copy
```
shell> ./tools/tpm install
```

If the installation process fails, check the output of the /tmp/tungsten-configure.log file for more information about the root cause.

Important

The above example assumes SSL is not enabled between the extractor and applier replicators.

If SSL is required, then you must omit the following properties from the example configs displayed above, or change the values to true: rmi-ssl=false, thl-ssl=false, rmi-authentication=false

Once you have installed the replicator, there are a few more steps required to allow the replicator to be able to authenticate with MongoDB Atlas.

4.5.4.1. Import MongoDB Atlas Certificates

MongoDB Atlas requires TLS connections for all Atlas Clusters, therefore we need to configure the replicator to recognise this.

Note

From May 1, 2021, MongoDB Atlas has moved to new TLS Certificiates using ISRG instead of IdenTrust for their root Certificate Authority.

All new clusters created after this time, or any existing clusters that have since been migrated to this new root CA will need to follow the correct procedure to configure the replicator. Both procedures are below, follow the correct one that relates to your configuration.

For MongoDB Atlas Cluster created PRIOR to May 1, 2021, or that have not yet migrated to the new LetsEncrypt root Certificate:

Using the correct Atlas Endpoint, issue the following command to retrieve the Atlas certificates
copy
```
shell> openssl s_client -showcerts -connect atlas-endpoint.mongodb.net:27017
```
The output may be quite long and will include at least two certificates bound by the header/footer as follows
```
-----BEGIN CERTIFICATE-----
xxxx
xxxx
-----END CERTIFICATE-----
```
Copy each certificate, including the header/footer, into individual files
Using keytool, we now need to load each certificte into the truststore that was created during the replicator installation. Repeat the example below for each certificate, ensuring you use a unique alias name for each certificate.
copy
```
shell> keytool -import -alias your-alias1 -file cert1.cer -keystore /opt/continuent/share/tungsten_truststore.ts
```
When prompted, the default password for the truststore will be tungsten unless you specified a different password during installation
Once this is complete, you can now start the replicator
copy
```
shell> replicator start
```

For MongoDB Atlas Cluster created AFTER May 1, 2021, or that have been migrated to the new LetsEncrypt root Certificate:

Obtain the LetsEncrypt root Certificate from here
Copy the certificate into a file called letsencrypt.pem in the home directory of the applier host, including the BEGIN an END header/footer, for example:
```
-----BEGIN CERTIFICATE-----
xxxx
xxxx
-----END CERTIFICATE-----
```
Using keytool, we now need to import this certificte into the truststore that was created during the replicator installation.
copy
```
shell> keytool -import -alias letsencrypt -file letsencrypt.pem -keystore /opt/continuent/share/tungsten_truststore.ts
```
When prompted, the default password for the truststore will be tungsten unless you specified a different password during installation
Once this is complete, you can now start the replicator
copy
```
shell> replicator start
```

openssl s_client -showcerts -connect atlas-endpoint.mongodb.net:27017
keytool -import -alias your-alias1 -file cert1.cer -keystore /opt/continuent/share/tungsten_truststore.ts
replicator start
keytool -import -alias letsencrypt -file letsencrypt.pem -keystore /opt/continuent/share/tungsten_truststore.ts
replicator start

Show Copy-friendly Text

Once the replicators have started, the status of the service can be checked using trepctl. See Section 4.5.5, “Management and Monitoring of MongoDB Deployments” for more information.

cd tungsten-replicator-7.0.3-141
./tools/tpm configure alpha \
--enable-heterogeneous-master=true
./tools/tpm update
tpm update
tar zxf tungsten-replicator-7.0.3-141.tar.gz
cd tungsten-replicator-7.0.3-141
./tools/tpm configure defaults \
    --reset \
    --install-directory=/opt/continuent \
    --profile-script=~/.bash_profile \
    --disable-security-controls=false \
    --rmi-ssl=false \
    --thl-ssl=false \
    --rmi-authentication=false \
    --rest-api-admin-user=apiuser \
    --rest-api-admin-pass=secret

./tools/tpm configure alpha \
    --master=sourcehost \
    --members=localhost \
    --datasource-type=mongodb \
    --replication-user=tungsten \
    --replication-password=secret \
    --svc-applier-filters=dropstatementdata \
    --role=slave \
    --replication-host=atlasendpoint.mongodb.net \
    --replication-port=27017 \
    --property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
vi /etc/tungsten/tungsten.ini
[defaults]
install-directory=/opt/continuent
profile-script=~/.bash_profile
disable-security-controls=false
rmi-ssl=false
thl-ssl=false
rmi-authentication=false
rest-api-admin-user=apiuser
rest-api-admin-pass=secret

[alpha]
master=sourcehost
members=localhost
datasource-type=mongodb
replication-user=tungsten
replication-password=secret
svc-applier-filters=dropstatementdata
role=slave
replication-host=atlasendpoint.mongodb.net
replication-port=27017
property=replicator.applier.dbms.connectString=mongodb+srv://${replicator.global.db.user}:${replicator.global.db.password}@${replicator.global.db.host}/?retryWrites=true&w=majority
./tools/tpm install
openssl s_client -showcerts -connect atlas-endpoint.mongodb.net:27017
keytool -import -alias your-alias1 -file cert1.cer -keystore /opt/continuent/share/tungsten_truststore.ts
replicator start
keytool -import -alias letsencrypt -file letsencrypt.pem -keystore /opt/continuent/share/tungsten_truststore.ts
replicator start

Show Copy-friendly Text

Prev	Up	Next
4.5.3. Install MongoDB Applier	^Level	4.5.5. Management and Monitoring of MongoDB Deployments

Continuent Documentation