Search: support multiple mongots

# Conflicts:
#	.evergreen-tasks.yml
#	.evergreen.yml
#	docker/mongodb-kubernetes-tests/tests/common/mongodb_tools_pod/mongodb_tools_pod.py
#	docker/mongodb-kubernetes-tests/tests/search/fixtures/search-sharded-external-mongod.yaml

Author: lsierant

.evergreen-tasks.yml

@@ -1360,6 +1360,16 @@ tasks:
     commands:
       - func: "e2e_test"
 
+  - name: e2e_search_sharded_enterprise_external_lb
+    tags: [ "patch-run" ]
+    commands:
+      - func: "e2e_test"
+
+  - name: e2e_search_sharded_enterprise_external_mongod
+    tags: [ "patch-run" ]
+    commands:
+      - func: "e2e_test"
+
   - name: e2e_search_sharded_external_mongod_single_mongot
     tags: [ "patch-run" ]
     commands:

.evergreen.yml

@@ -812,6 +812,8 @@ task_groups:
       - e2e_search_enterprise_tls
       - e2e_search_enterprise_x509_cluster_auth
       - e2e_search_sharded_external_mongod_single_mongot
+      - e2e_search_sharded_enterprise_external_lb
+      - e2e_search_sharded_enterprise_external_mongod
     <<: *teardown_group
 
   # this task group contains just a one task, which is smoke testing whether the operator

api/v1/search/mongodbsearch_types.go

@@ -2,6 +2,7 @@ package search
 
 import (
 	"fmt"
+	"strings"
 
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
@@ -16,6 +17,9 @@ import (
 	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/api/v1/common"
 )
 
+// ShardNamePlaceholder is the placeholder used in endpoint templates for sharded clusters
+const ShardNamePlaceholder = "{shardName}"
+
 const (
 	MongotDefaultWireprotoPort      int32 = 27027
 	MongotDefaultGrpcPort           int32 = 27028
@@ -51,6 +55,15 @@ type MongoDBSearchSpec struct {
 	// MongoDB database connection details from which MongoDB Search will synchronize data to build indexes.
 	// +optional
 	Source *MongoDBSource `json:"source"`
+	// Replicas is the number of mongot pods to deploy.
+	// For ReplicaSet source: this many mongot pods total.
+	// For Sharded source: this many mongot pods per shard.
+	// When Replicas > 1, a load balancer configuration (lb.mode: Unmanaged with lb.endpoint)
+	// is required to distribute traffic across mongot instances.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:default=1
+	Replicas int `json:"replicas,omitempty"`
 	// StatefulSetSpec which the operator will apply to the MongoDB Search StatefulSet at the end of the reconcile loop. Use to provide necessary customizations,
 	// which aren't exposed as fields in the MongoDBSearch.spec.
 	// +optional
@@ -75,6 +88,41 @@ type MongoDBSearchSpec struct {
 	// `embedding` field of mongot config is generated using the values provided here.
 	// +optional
 	AutoEmbedding *EmbeddingConfig `json:"autoEmbedding,omitempty"`
+	// LoadBalancer configures how mongod/mongos connect to mongot (Managed vs Unmanaged/BYO LB).
+	// +optional
+	LoadBalancer *LoadBalancerConfig `json:"lb,omitempty"`
+}
+
+// LBMode defines the load balancer mode for Search
+// +kubebuilder:validation:Enum=Managed;Unmanaged
+type LBMode string
+
+const (
+	// LBModeManaged indicates operator-managed Envoy load balancer
+	LBModeManaged LBMode = "Managed"
+	// LBModeUnmanaged indicates user-provided L7 load balancer (BYO LB)
+	LBModeUnmanaged LBMode = "Unmanaged"
+)
+
+// LoadBalancerConfig configures how mongod/mongos connect to mongot
+type LoadBalancerConfig struct {
+	// Mode specifies the load balancer mode: Managed (operator-managed) or Unmanaged (BYO L7 LB)
+	// +kubebuilder:validation:Required
+	Mode LBMode `json:"mode"`
+	// Endpoint is the LB endpoint for ReplicaSet, or a template for sharded clusters.
+	// For sharded clusters, use {shardName} as a placeholder substituted with the actual shard name.
+	// Example: "lb-{shardName}.example.com:27028"
+	// +optional
+	Endpoint string `json:"endpoint,omitempty"`
+	// Envoy contains configuration for operator-managed Envoy load balancer
+	// +optional
+	Envoy *EnvoyConfig `json:"envoy,omitempty"`
+}
+
+// EnvoyConfig contains configuration for operator-managed Envoy load balancer
+// Placeholder for future Envoy configuration options
+type EnvoyConfig struct {
+	// Placeholder for future Envoy configuration
 }
 
 type EmbeddingConfig struct {
@@ -400,6 +448,59 @@ func (s *MongoDBSearch) GetPrometheus() *Prometheus {
 	return s.Spec.Prometheus
 }
 
+func (s *MongoDBSearch) IsLBModeUnmanaged() bool {
+	return s.Spec.LoadBalancer != nil && s.Spec.LoadBalancer.Mode == LBModeUnmanaged
+}
+
+// IsReplicaSetUnmanagedLB returns true if this is a ReplicaSet unmanaged LB configuration.
+// An endpoint with a template placeholder ({shardName}) is NOT considered a ReplicaSet endpoint.
+func (s *MongoDBSearch) IsReplicaSetUnmanagedLB() bool {
+	return s.IsLBModeUnmanaged() &&
+		s.Spec.LoadBalancer.Endpoint != "" &&
+		!s.HasEndpointTemplate()
+}
+
+func (s *MongoDBSearch) GetReplicaSetUnmanagedLBEndpoint() string {
+	if !s.IsReplicaSetUnmanagedLB() {
+		return ""
+	}
+	return s.Spec.LoadBalancer.Endpoint
+}
+
+// HasEndpointTemplate returns true if the endpoint contains the {shardName} template placeholder
+func (s *MongoDBSearch) HasEndpointTemplate() bool {
+	if s.Spec.LoadBalancer == nil {
+		return false
+	}
+	return strings.Contains(s.Spec.LoadBalancer.Endpoint, ShardNamePlaceholder)
+}
+
+// IsShardedUnmanagedLB returns true if this is a sharded unmanaged LB configuration
+// identified by the presence of the {shardName} template placeholder in the endpoint.
+func (s *MongoDBSearch) IsShardedUnmanagedLB() bool {
+	return s.IsLBModeUnmanaged() && s.HasEndpointTemplate()
+}
+
+// GetEndpointForShard returns the endpoint for a specific shard by substituting
+// the {shardName} placeholder in the endpoint template.
+func (s *MongoDBSearch) GetEndpointForShard(shardName string) string {
+	if !s.IsShardedUnmanagedLB() {
+		return ""
+	}
+	return strings.ReplaceAll(s.Spec.LoadBalancer.Endpoint, ShardNamePlaceholder, shardName)
+}
+
+func (s *MongoDBSearch) GetReplicas() int {
+	if s.Spec.Replicas > 0 {
+		return s.Spec.Replicas
+	}
+	return 1
+}
+
+func (s *MongoDBSearch) HasMultipleReplicas() bool {
+	return s.GetReplicas() > 1
+}
+
 func (s *MongoDBSearch) MongotStatefulSetNamespacedNameForShard(shardName string) types.NamespacedName {
 	return types.NamespacedName{Name: fmt.Sprintf("%s-mongot-%s", s.Name, shardName), Namespace: s.Namespace}
 }

api/v1/search/mongodbsearch_validation.go

@@ -0,0 +1,107 @@
+package search
+
+import (
+	"errors"
+	"strings"
+
+	v1 "github.com/mongodb/mongodb-kubernetes/api/v1"
+)
+
+// ValidateSpec validates the MongoDBSearch spec
+func (s *MongoDBSearch) ValidateSpec() error {
+	for _, res := range s.RunValidations() {
+		if res.Level == v1.ErrorLevel {
+			return errors.New(res.Msg)
+		}
+	}
+	return nil
+}
+
+// RunValidations runs all validation rules and returns the results
+func (s *MongoDBSearch) RunValidations() []v1.ValidationResult {
+	validators := []func(*MongoDBSearch) v1.ValidationResult{
+		validateLBConfig,
+		validateUnmanagedLBConfig,
+		validateEndpointTemplate,
+		validateTLSConfig,
+	}
+
+	var results []v1.ValidationResult
+	for _, validator := range validators {
+		res := validator(s)
+		if res.Level > 0 {
+			results = append(results, res)
+		}
+	}
+	return results
+}
+
+// validateLBConfig validates the load balancer configuration
+func validateLBConfig(s *MongoDBSearch) v1.ValidationResult {
+	if s.Spec.LoadBalancer == nil {
+		// LB config is optional
+		return v1.ValidationSuccess()
+	}
+
+	// Mode must be specified if LB config is present
+	if s.Spec.LoadBalancer.Mode == "" {
+		return v1.ValidationError("spec.lb.mode must be specified when spec.lb is configured")
+	}
+
+	// Mode must be either Managed or Unmanaged
+	if s.Spec.LoadBalancer.Mode != LBModeManaged && s.Spec.LoadBalancer.Mode != LBModeUnmanaged {
+		return v1.ValidationError("spec.lb.mode must be either 'Managed' or 'Unmanaged', got '%s'", s.Spec.LoadBalancer.Mode)
+	}
+
+	return v1.ValidationSuccess()
+}
+
+// validateUnmanagedLBConfig validates that an endpoint is specified when mode is Unmanaged
+func validateUnmanagedLBConfig(s *MongoDBSearch) v1.ValidationResult {
+	if s.Spec.LoadBalancer == nil || s.Spec.LoadBalancer.Mode != LBModeUnmanaged {
+		return v1.ValidationSuccess()
+	}
+
+	if s.Spec.LoadBalancer.Endpoint == "" {
+		return v1.ValidationError("spec.lb.endpoint must be specified when spec.lb.mode is 'Unmanaged'")
+	}
+
+	return v1.ValidationSuccess()
+}
+
+// validateEndpointTemplate validates the endpoint template format
+func validateEndpointTemplate(s *MongoDBSearch) v1.ValidationResult {
+	if !s.HasEndpointTemplate() {
+		return v1.ValidationSuccess()
+	}
+
+	endpoint := s.Spec.LoadBalancer.Endpoint
+
+	// Template must contain exactly one {shardName} placeholder
+	count := strings.Count(endpoint, ShardNamePlaceholder)
+	if count != 1 {
+		return v1.ValidationError("spec.lb.endpoint template must contain exactly one %s placeholder, found %d", ShardNamePlaceholder, count)
+	}
+
+	// Template should have some content before or after the placeholder
+	if endpoint == ShardNamePlaceholder {
+		return v1.ValidationError("spec.lb.endpoint template must contain more than just the %s placeholder", ShardNamePlaceholder)
+	}
+
+	return v1.ValidationSuccess()
+}
+
+// validateTLSConfig validates the TLS configuration
+func validateTLSConfig(s *MongoDBSearch) v1.ValidationResult {
+	if s.Spec.Security.TLS == nil {
+		return v1.ValidationSuccess()
+	}
+
+	// TLS is valid in all cases:
+	// 1. CertificateKeySecret.Name is specified - use explicit secret name
+	// 2. CertsSecretPrefix is specified - use {prefix}-{resourceName}-search-cert
+	// 3. Both are empty - use default {resourceName}-search-cert
+	// No validation error needed as we always have a valid fallback
+
+	return v1.ValidationSuccess()
+}

api/v1/search/zz_generated.deepcopy.go

@@ -78,6 +78,30 @@ spec:
                 required:
                 - embeddingModelAPIKeySecret
                 type: object
+              lb:
+                description: LoadBalancer configures how mongod/mongos connect to
+                  mongot (Managed vs Unmanaged/BYO LB).
+                properties:
+                  endpoint:
+                    description: |-
+                      Endpoint is the LB endpoint for ReplicaSet, or a template for sharded clusters.
+                      For sharded clusters, use {shardName} as a placeholder substituted with the actual shard name.
+                      Example: "lb-{shardName}.example.com:27028"
+                    type: string
+                  envoy:
+                    description: Envoy contains configuration for operator-managed
+                      Envoy load balancer
+                    type: object
+                  mode:
+                    description: 'Mode specifies the load balancer mode: Managed (operator-managed)
+                      or Unmanaged (BYO L7 LB)'
+                    enum:
+                    - Managed
+                    - Unmanaged
+                    type: string
+                required:
+                - mode
+                type: object
               logLevel:
                 description: Configure verbosity of mongot logs. Defaults to INFO
                   if not set.
@@ -148,6 +172,16 @@ spec:
                     minimum: 0
                     type: integer
                 type: object
+              replicas:
+                default: 1
+                description: |-
+                  Replicas is the number of mongot pods to deploy.
+                  For ReplicaSet source: this many mongot pods total.
+                  For Sharded source: this many mongot pods per shard.
+                  When Replicas > 1, a load balancer configuration (lb.mode: Unmanaged with lb.endpoint)
+                  is required to distribute traffic across mongot instances.
+                minimum: 1
+                type: integer
               resourceRequirements:
                 description: Configure resource requests and limits for the MongoDB
                   Search pods.

config/crd/bases/mongodb.com_mongodbsearch.yaml

@@ -135,7 +135,9 @@ func (r *MongoDBSearchReconciler) getSourceMongoDBForSearch(ctx context.Context,
 		}
 	} else {
 		r.watch.AddWatchedResourceIfNotAdded(sourceMongoDBResourceRef.Name, sourceMongoDBResourceRef.Namespace, watch.MongoDB, search.NamespacedName())
-		if mdb.GetResourceType() == mdbv1.ShardedCluster {
+		// For sharded clusters with unmanaged LB mode, use ShardedEnterpriseSearchSource
+		// which provides per-shard host seeds and endpoint mapping.
+		if mdb.GetResourceType() == mdbv1.ShardedCluster && search.IsShardedUnmanagedLB() {
 			return searchcontroller.NewShardedEnterpriseSearchSource(mdb, search), nil
 		}
 		return searchcontroller.NewEnterpriseResourceSearchSource(mdb), nil