Release of MCK 1.9.1

MCK 1.9.1 Release Notes

Bug Fixes

• MongoDBUser: Fixed a 401 TOO_MANY_GROUP_TAGS error caused by the operator tagging the Ops Manager project with the namespace of every MongoDBUser. The user controller no longer adds namespace tags to the project.
• MongoDB: Fixed an issue where automation-agent-stderr.log could grow unboundedly on the persistent volume and fill the PVC. The automation agent's stderr is now streamed directly to the pod's stdout instead of written to a file.
• MongoDBSearch: The minimum Ops Manager version required for Search metrics to be forwarded to Ops Manager is now 8.0.25 due to a bug in 8.0.24.

Other Changes

• Removed the preliminary scale-down step that set votes and priority to 0 for replica set members before removing them. This step is not necessary anymore since the agent can handle the removal of voting members.

Release of MCK 1.9.0

MongoDB Search and Vector Search now Generally Available with MCK

MongoDB Search and Vector Search is now generally available for Enterprise Advanced and supported for production use, graduating from public preview. In addition, Auto Embeddings for Enterprise is now in Public Preview. For more details, see the full documentation.

With MongoDB Search and Vector Search, the operator runs MongoDB's Search engine (mongot) right alongside your database, wherever they are (in Kubernetes, VMs or bare-metal), so you can add full-text and vector search to your Kubernetes deployments without standing up and managing a separate search system. See more here.

What's New

Auto Embeddings (Public Preview): Added support for auto embeddings in MongoDB Enterprise to automatically generate vector embeddings for the vector search data. All the details can be found in our public documentation.

Add support to password-encrypted key file: This release gives you more ways to meet your security and compliance requirements for the connection between MongoDB and mongot:

• Use a password-encrypted private key on the gRPC connection between mongot and mongod/mongos.
• Use client TLS (including a password-encrypted key) on the SCRAM sync-source connection.
• Keep the password for an encrypted x509 client key in its own dedicated Kubernetes Secret.

In each case you supply the decryption password through a Kubernetes Secret, and you can leave it out entirely when your key isn't encrypted.

Monitoring in Ops Manager: Search metrics can now flow straight into Ops Manager, next to the rest of your deployment, no extra monitoring stack required. Turn it on with the new metrics forwarder, point it at your Ops Manager project, and track its health from the resource's status.
Ops Manager 8.0.24 has a critical issue that will prevent startup preflight from completing, causing a restart loop after the next restart once Search hosts are registered. The MCK 1.9.1 hotfix release will disable Search monitoring until a newer Ops Manager is deployed. In the meantime it's advisable to explicitly disable Search monitoring in Ops Manager by explicitly setting .spec.observability.metricsForwarder.mode to disabled in each MongoDBSearch resource.

Choose the sync source using their tag: You can now direct mongot to sync from specific members using their replica set tags. For example, automatically detect and sync from a set of members tagged eu-west. This can help customers with data-locality requirements.

Additional load balancer and tuning options: This release also adds a retry policy and configurable pod count for the managed (Envoy) load balancer, a readiness threshold for how many search replicas must be ready before it routes traffic, advanced pass-through configuration for mongot, and a toggle for its overload-retry signal.

Minimum required versions for Search GA:

• MongoDB Server: 8.3.0
• Ops Manager: 8.0.25
• Search (mongot): 1.70.1

The default Search version is now 1.70.1, if spec.version is not defined.

Breaking Changes from the Search and Vector Search Public Preview

If you're coming from the Search preview, a migration guide is available for the MongoDBSearch schema.

API Changes

We are introducing relevant changes in the GA release in comparison to the Public Preview in order to bring more clarity to the API design and to introduce new features and capabilities to be production ready.

The changes are listed below:

• spec.observability.metricsForwarder (+ .opsManager): Forwards mongot metrics to Ops Manager. opsManager holds the project config and agent credentials. Status is surfaced under status.metricsForwarder. Default: off.
• spec.security.tls.keyFilePasswordSecretRef: The Kubernetes Secret holding the password that decrypts a password-encrypted private key for the gRPC connection between mongod/mongos and mongot. Omit if the key isn't encrypted.
• spec.source.tls.clientCertificateSecretRef: Client certificate mongot presents during the TLS handshake on the SCRAM sync-source connection.
• spec.source.tls.keyFilePasswordSecretRef: The Kubernetes Secret holding the password that decrypts a password-encrypted SCRAM client key.
• spec.source.x509.keyFilePasswordSecretRef: The Kubernetes Secret holding the password that decrypts a password-encrypted x509 client key. Replaces the old tls.keyFilePassword entry embedded in the x509 client-certificate Secret, which is no longer used.
• spec.clusters[].advancedMongotConfigs: Passes extra tuning configuration through to the mongot process.
• spec.clusters[].syncSourceSelector.matchTagSets: Controls which replica set members mongot reads from (maps to mongot's replicationReader.tagSets).
• spec.clusters[].loadBalancer.managed.retryPolicy: Envoy retry policy (numRetries, perTryTimeout). Default: 2 retries, 60s per try.
• spec.clusters[].loadBalancer.managed.minMongotReadyReplicas: Minimum ready mongot replicas in a group before Envoy routes real traffic to it. Default: 1.
• spec.clusters[].loadBalancer.managed.replicas: Number of Envoy proxy pods for the managed load balancer. Default: 1.
• spec.featureFlags.enableOverloadRetrySignal: Enables/disables mongot's OVERLOAD_RETRY_SIGNAL feature flag. Default: true.
• .spec.prometheus field has moved to .spec.observability.prometheus. Update your MongoDBSearch resources to use the new path. Prometheus metrics are now enabled by default. Set .spec.observability.prometheus.mode to disabled to disable them.

General Changes

New Features

• MongoDB and MongoDBUser resources now expose the reconciled Ops Manager project ID in .status.projectId.

Bug Fixes

• To follow the Pod Security Standards more secure default pod securityContext settings were added.
  Operator deployment securityContext settings that have changed:

  • allowPrivilegeEscalation: false
  • capabilities.drop: [ ALL ]
  • seccompProfile.type: RuntimeDefault

  Other workloads:

  • capabilities.drop: [ ALL ] - container level
  • seccompProfile.type: RuntimeDefault - pod level

  If you require less restrictive securityContext settings please use template or podTemplate overrides.
  Detailed information about overrides can be found in Modify Ops Manager or MongoDB Kubernetes Resource Containers.

• MongoDBOpsManager: Fixed an issue in the MongoDBOpsManager resource where JVM parameter blocks were appended to mms.conf on every pod restart without removing previous entries, causing duplicate configuration entries to accumulate.

• MongoDBMulticluster: Fixed an issue where reconciliation of an entire resource could be blocked if automatic failover was disabled and a member cluster was marked as failed. Now, the operator will reconcile healthy clusters and skip the failed clusters.

• MongoDBMulticluster: When automatic failover is disabled, the operator will now remove the failed clusters annotation once the clusters respond successfully to health checks a consecutive number of times, allowing for recovery without manual intervention. The number of consecutive successful health checks required to remove the failed annotation is configurable via the MDB_MEMBER_CLUSTER_REQUIRED_HEALTHY_STREAK environment variable, or the multiCluster.memberClusterRequiredHealthyStreak helm value. The default is 5.

• MongoDB: Fixed a bug where setting a field to null in additionalMongodConfig to remove it from a deployment did not take effect. The field would either be ignored or reappear on the next reconciliation.

• MongoDBOpsManager, MongoDB, MongoDBMultiCluster, MongoDBUser: Fixed a bug in multi-cluster mode where Service, ConfigMap, TLS Secret, and StatefulSet resources created in member clusters carried ownerReferences pointing to the Custom Resource in the central cluster, causing the Kubernetes garbage collector to delete them as orphans.

• MongoDB, MongoDBMultiCluster, MongoDBOpsManager, AppDB: Fixed a bug where reconciliation did not consistently trigger after StatefulSet resource changes in single-cluster and multi-cluster deployments.

• OpsManager AppDB: Fixed an issue where the status.applicationDatabase.pvc field in the MongoDBOpsManager CRD retained a stale PVC Resize - STS has been orphaned phase indefinitely after a PVC resize completed successfully.

• MongoDBUser: Passwords containing spaces or plus signs are now correctly percent-encoded in generated connection string secrets. Spaces are encoded as %20 and plus signs as %2B, ensuring both the Go driver and pymongo decode credentials correctly.

Release of MCK 1.8.1

MCK 1.8.1 Release Notes

Bug Fixes

• MongoDBUser: The authSource parameter in generated connection string secrets now correctly reflects spec.db instead of always being set to admin. This affects all authentication modes, including SCRAM-SHA-256, SCRAM-SHA-1, and X.509 (where authSource=$external is now correctly set).
• MongoDBOpsManager, AppDB: In multi-cluster AppDB topology, fixed a bug where the per-cluster spec.applicationDatabase.clusterSpecList[i].statefulSet override was silently ignored.

Release of MCK 1.8.0

MCK 1.8.0 Release Notes

New Features

• MongoDBSearch (Public Preview): The MongoDBSearch resource now supports horizontal scaling, L7 load balancing, and sharded MongoDB cluster support — significantly expanding the capabilities of full-text search and vector search on Enterprise Advanced.

  Sharded cluster support

  • The MongoDBSearch resource now supports sharded MongoDB clusters as a source, in addition to replica sets. The operator deploys a dedicated mongot group per shard and manages routing independently for each one. Both operator-managed and externally-managed sharded clusters are supported.

  Horizontal scaling and load balancing

  • Search workloads can now scale horizontally with multiple mongot replicas through spec.replicas. For replica sets, this controls the total mongot pods. For sharded clusters, it controls the number of mongot pods per shard.
  • Multi-mongot deployments require L7 load balancing. The operator can deploy and manage an Envoy proxy (spec.loadBalancer.managed) that handles gRPC stream-level balancing between mongod and mongot. Alternatively, spec.loadBalancer.unmanaged lets you bring your own proxy infrastructure.

  Security and configuration

  • Added x509 client certificate authentication for mongot-to-mongod connections through spec.source.x509, as an alternative to username and password authentication.
  • Added convention-based TLS secret naming through spec.security.tls.certsSecretPrefix, enabling automatic per-shard TLS certificate discovery. We recommend using certsSecretPrefix for new deployments.
  • Added support for custom JVM flags through spec.jvmFlags (for example, -Xms, -Xmx). If heap size flags are not configured, the operator automatically sets the heap size to half of the container's memory request.
  • Updated the default mongodb/mongodb-search image version to 0.64.0. It is the minimum mongot version supported by the operator. Previous versions will not work correctly and will report not ready state.
  • Updated the default resource requests for search pods to 2 CPUs and 4Gi of memory (previously 2 CPUs and 2G).

  For configuration examples and the full API reference, see the MongoDBSearch documentation.

Bug Fixes

• MongoDBOpsManager: Correctly handle the edge case where -admin-key was created by user and malformed. Previously the error was only presented in DEBUG log entry.
• MongoDBOpsManager: Improved readiness probe error handling and appDB agent status logging
• MongoDB: Added a 60 seconds delay before enabling backup for sharded clusters to avoid race condition between Ops Manager topology discovery and backup enablement.
• MongoDBOpsManager: Ops Manager and BackupDaemon services no longer set publishNotReadyAddresses: true. This previously caused reverse proxies (e.g. Traefik) to route traffic to NotReady pods during rolling upgrades, making Ops Manager temporarily unavailable.

Other Changes

• Container images: Merged the init-database and init-appdb init container images into a single init-database image. The init-appdb image will no longer be published and does not affect existing deployments.
  • The following Helm chart values have been removed: initAppDb.name, initAppDb.version, and registry.initAppDb. Use initDatabase.name, initDatabase.version, and registry.initDatabase instead.
  • The following environment variables have been removed: INIT_APPDB_IMAGE_REPOSITORY and INIT_APPDB_VERSION. Use INIT_DATABASE_IMAGE_REPOSITORY and INIT_DATABASE_VERSION instead.
• Helm Chart: Removed operator.baseName Helm value. This value was never intended to be consumed by operator users and was never documented. The value controls the prefix for workload RBAC resource names (mongodb-kubernetes default), but changing it could break the operator and workloads because the operator is not aware of custom prefixes. With this change, the Helm chart will no longer allow customisation and the relevant resources will be deployed with predefined names (ServiceAccount with names mongodb-kubernetes-appdb, mongodb-kubernetes-database-pods, mongodb-kubernetes-ops-manager, Role with name mongodb-kubernetes-appdb and RoleBinding with name mongodb-kubernetes-appdb).

Release of MCK 1.7.0

MCK 1.7.0 Release Notes

New Features

• Auto embeddings: Added support for auto embeddings in MongoDB Community to automatically generate vector embeddings for the vector search data. This document can be followed for detailed documentation
• MongoDBSearch: Updated the default mongodb/mongodb-search image version to 0.60.1. This is the version MCK uses if .spec.version is not specified.
• Added support for configurable ValidatingWebhookConfiguration name via operator.webhook.name helm value.
• MongoDBOpsManager: Added field spec.backup.s3Stores[].objectLockEnabled in the MongoDBOpsManager resource for specifying whether the S3 bucket has Object Lock enabled. This flag is only allowed for Ops Manager version >= 8.0.19 and it is needed for enabling immutable backups.
• Allows users to override any Ops Manager emptyDir mount with their own PVCs via overrides statefulSet.spec.volumeClaimTemplates.

Bug Fixes

• Fixed an issue where the operator would crash when securityContext.readOnlyRootFilesystem=true was set in the helm chart values. The operator now creates an emptyDir volume for the webhook certificate.
• Fix an issue to ensure that hosts are consistently removed from Ops Manager monitoring during AppDB scale-down events.
• Fixed an issue where monitoring agents would fail after disabling TLS on a MongoDB deployment.
• Persistent Volume Claim resize fix: Fixed an issue where the Operator ignored namespaces when listing PVCs, causing conflicts with resizing PVCs of the same name. Now, PVCs are filtered by both name and namespace for accurate resizing.
• Fixed a panic that occurred when the domain names for a horizon was empty. Now, if the domain names are not valid (RFC 1123), the validation will fail before reconciling.
• MongoDBMultiCluster, MongoDB: Fix an issue where the operator skipped host removal when an external domain was used, leaving monitoring hosts in Ops Manager even after workloads were correctly removed from the cluster.
• Fix non-deterministic topologySpreadConstraints generated order (classic Go "bug" iterating over a map)
• Fixed an issue where the Operator could crash when TLS certificates are configured using the certificatesSecretsPrefix field without additional TLS settings.
• MongoDBOpsManager, AppDB: Block removing a member cluster while it still has non-zero members. This prevents scaling down without the preserved configuration and avoids unexpected issues.
• Fixed an issue where redeploying a MongoDB resource after deletion could fail with 409 "version not available" errors due to stale agent credentials in Ops Manager.
• Fixed Statefulset update logic that might result in triggering rolling restart in more than one member cluster at a time.

Release of MCK 1.6.1

MCK 1.6.1 Release Notes

Bug Fixes

• Backed up the agent password in a secret for SCRAM authentication to prevent unnecessary password rotations.
• MongoDB Adding missing ownerrefs to ensure proper resource deletion by kubernetes.
• Single Cluster Deleting resources created by CRD now only happens on multi-cluster deployments. Single Cluster will solely rely on ownerrefs.
• MongoDB, MongoDBOpsManager: Improve validation for featureCompatibilityVersion field in MongoDB and MongoDBOpsManager spec. The field now enforces proper semantic versioning. Previously, invalid semver values could be accepted,
  potentially resulting in incorrect configurations.
• Roles configured via Ops Manager UI or API will no longer be removed by the operator
• A new debug sidecar has been introduced to remove the runtime download of Go and Delve from the agent-launcher script. Instead of enabling agent debugging via the script, debugging is now controlled by the operator. When MDB_AGENT_DEBUG is set to true in the private context, the operator injects a debug sidecar that runs Delve and attaches to the agent process.

Other Changes

• A new asset, release_info_<mck-version>.json, is now included with all releases. It documents the latest available versions of all container images used by MongoDB Controllers for Kubernetes at the time of release. This file is provided for informational purposes only and does not define the full support matrix. The format and contents are experimental and may change in future releases, including potential breaking changes for programmatic consumers.
• Operator configuration: Removed the unused MDB_IMAGE_TYPE environment variable and the corresponding mongodb.imageType Helm value. This variable was deprecated in v1.28.0 of the MongoDB Enterprise Kubernetes Operator when it switched to architecture-based image selection (ubi9 for static, ubi8 for non-static). This is a cleanup change with no functional impact.

Release of MCK 1.6.0

MCK 1.6.0 Release Notes

New Features

• MongoDBCommunity: Added support to configure custom cluster domain via newly introduced spec.clusterDomain resource field. If spec.clusterDomain is not set, environment variable CLUSTER_DOMAIN is used as cluster domain. If the environment variable CLUSTER_DOMAIN is also not set, operator falls back to cluster.local as default cluster domain.
• Helm Chart: Introduced two new helm fields operator.podSecurityContext and operator.securityContext that can be used to configure securityContext for Operator deployment through Helm Chart.
• MongoDBSearch:
  • Search with Community now in Public Preview: users can run Search with MongoDB Community Server with MCK.
  • MongoDB Server 8.2.0 is now the minimum supported version to run Search.
  • Switched to gRPC and mTLS for internal communication between mongod and mongot.
    • Since MCK 1.4 the mongod and mongot processess communicated using the MongoDB Wire Protocol and used keyfile authentication. This release switches that to gRPC with mTLS authentication. gRPC will allow for load-balancing search queries against multiple mongot processes in the future, and mTLS decouples the internal cluster authentication mode and credentials among mongod processes from the connection to the mongot process. The Operator will automatically enable gRPC for existing and new workloads, and will enable mTLS authentication if both Database Server and MongoDBSearch resource are configured for TLS.
  • Exposed configuration settings for mongot's prometheus metrics endpoint.
    • By default, if spec.prometheus field is not provided then metrics endpoint in mongot is disabled. This is a breaking change. Previously the metrics endpoing was always enabled on port 9946.
    • To enable prometheus metrics endpoint specify empty spec.prometheus: field. It will enable metrics endpoint on a default port (9946). To change the port, set it in spec.prometheus.port field.
  • Simplified MongoDB Search setup: Removed the custom Search Coordinator polyfill (a piece of compatibility code previously needed to add the required permissions), as MongoDB 8.2.0 and later now include the necessary permissions via the built-in searchCoordinator role.
  • Updated the default mongodb/mongodb-search image version to 0.55.0. This is the version MCK uses if .spec.version is not specified.
  • MongoDB deployments using X509 internal cluster authentication are now supported. Previously MongoDB Search required SCRAM authentication among members of a MongoDB replica set. Note: SCRAM client authentication is still required, this change merely relaxes the requirements on internal cluster authentication.

Bug Fixes

• Fixed parsing of the customEnvVars Helm value when values contain = characters.
• ReplicaSet: Blocked disabling TLS and changing member count simultaneously. These operations must now be applied separately to prevent configuration inconsistencies.
• MongoDBSearch now records the reconciled mongot version in status and exposes it via a dedicated kubectl print column.
• Fixed inability to specify cluster-wide privileges in custom roles.

Other Changes

• kubectl-mongodb plugin: cosign, the signing tool that is used to sign kubectl-mongodb plugin binaries, has been updated to version 3.0.2. With this change, released binaries will be bundled with .bundle files containing both signature and certificate information. For more information on how to verify signatures using new cosign version please refer to -> https://github.com/sigstore/cosign/blob/v3.0.2/doc/cosign_verify-blob.md

Release of MCK 1.5.0

MCK 1.5.0 Release Notes

New Features

• Improved automation agent certificate rotation: the agent now restarts automatically when its certificate is renewed, ensuring smooth operation without manual intervention and allowing seamless certificate updates without requiring manual Pod restarts.

Bug Fixes

• MongoDBMultiCluster: Fixed resource stuck in Pending state if any clusterSpecList item has 0 members. After the fix, a value of 0 members is handled correctly, similarly to how it's done in the MongoDB resource.
• MultiClusterSharded: Blocked removing non-zero member cluster from MongoDB resource. This prevents from scaling down member cluster without current configuration available, which could lead to unexpected issues.

Release of MCK 1.4.0

We are excited to announce the release of the MongoDB Controller for Kubernetes (MCK) 1.4, which introduces the Public Preview of Search and Vector Search for use with self-managed MongoDB Enterprise Server deployments.

This release brings powerful, proven search capabilities from MongoDB Atlas directly to your self-managed environments, enabling you to build, test, and run modern, AI-powered applications on your own infrastructure. You can now eliminate the architectural complexity and operational overhead of managing separate search systems or standalone vector databases.

New Features: Search & Vector Search (Public Preview)

This public preview is the first milestone in bringing fully integrated full-text and vector search to your enterprise deployments.

• MongoDB Enterprise Server Support: This preview is compatible with MongoDB Enterprise Server version 8.0.10+ and is intended for testing, evaluation, and feedback.
• Flexible Topologies: The search process (mongot) must run in Kubernetes, but your database cluster (mongod) can run on your existing infrastructure—either inside the same Kubernetes cluster or on external VMs and bare-metal servers. This allows you to adopt powerful search features without needing to migrate your current database workloads.
• Replica Set Support: The initial preview supports deployments running as replica sets.
• Secure Connectivity: All communication between the mongod and mongot processes can be secured using TLS encryption.

Coming Soon

This release is the first in a series of incremental updates planned through the end of 2025. While it already delivers important functionality, several key enhancements are on our short-term roadmap, including:

• Support for sharded clusters.
• High availability via multiple mongot instances.
• Support for gRPC and mTLS.

Learn More

• Check out the public preview documentation for setup and configuration details
• Read our blog post for a deep dive into this release and its capabilities

Release of MCK 1.3.0

MCK 1.3.0 Release Notes

New Features

Multi-Architecture Support

The Kubernetes Operator now supports deployment on multiple CPU architectures, allowing for greater flexibility in your environment. Current supported architectures:

• ARM64 (arm64)
• IBM Power (ppc64le)
• IBM Z (s390x)
• Intel/AMD (x86_64) (existing)

Affected Components: Multi-architecture support has been enabled for all core container images, including the operator, agent, init containers, database, and readiness probe. The container runtime will automatically pull the correct image for your node's architecture.

Important Limitation: Please note that Ops Manager and the init-ops-manager image are not included in this update.

Important Changes Related to the MongoDB Agent Images

We're deprecating quay.io/mongodb/mongodb-agent-ubi repository in favor of quay.io/mongodb/mongodb-agent. Please note:

• Default urls in the helm chart contains the new repo.
  • If you don't customize those url, you don't need to change anything.
  • If you do please migrate to the new mongodb-agent.
• The new mongodb-agent contains multi-arch images, while the deprecated one does not.
• mongodb-agent-ubi is kept only for backwards compatibility, please do not use it anymore.

Bug Fixes

• We've fixed the current complex and difficult-to-maintain architecture for stateful set containers, which relies on an "agent matrix" to map operator and agent versions which led to a sheer amount of images.
• For static containers: We've shifted to a 3-container setup (database, agent, utilities-holder). This new design eliminates the need for the operator-version/agent-version matrix by adding one additional container containing all required binaries. This architecture maps to what we already do with the mongodb-database container.
• Fixed an issue where the readiness probe reported the node as ready even when its authentication mechanism was not in sync with the other nodes, potentially causing premature restarts.
• Fixed an issue where the MongoDB Agents did not adhere to the NO_PROXY environment variable configured on the operator.
• Changed webhook ClusterRole and ClusterRoleBinding default names to include the namespace. This ensures that multiple operator installations in different namespaces don't conflict with each other.

Other Changes

• Optional permissions for PersistentVolumeClaim moved to a separate role. When managing the operator with Helm it is possible to disable permissions for PersistentVolumeClaim resources by setting operator.enablePVCResize value to false (true by default). When enabled, previously these permissions were part of the primary operator role. With this change, permissions have a separate role.
• subresourceEnabled Helm value was removed. This setting used to be true by default and made it possible to exclude subresource permissions from the operator role by specifying false as the value. We are removing this configuration option, making the operator roles always have subresource permissions. This setting was introduced as a temporary solution for this OpenShift issue. The issue has since been resolved and the setting is no longer needed.
• We have deliberately not published the container images for OpsManager versions 7.0.16, 8.0.8, 8.0.9 and 8.0.10 due to a bug in the OpsManager which prevents MCK customers to upgrade their OpsManager deployments to those versions.