mongodb-kubernetes-fips

packaged by Chainguard

Chainguard Container for mongodb-kubernetes-fips

Chainguard's FIPS-enabled MongoDB Controllers for Kubernetes (MCK) image provides the unified MongoDB operator, the successor to the separate Community and Enterprise operators, for deploying and managing MongoDB deployments in Kubernetes.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/mongodb-kubernetes-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Chainguard's MongoDB Controllers for Kubernetes (MCK) image is comparable to the upstream mongodb-kubernetes image. MCK is the unified operator that supersedes the separate MongoDB Community and Enterprise Kubernetes operators.

If you run Chainguard's mongodb-kubernetes-operator-fips image, this is your migration target: its upstream project, mongodb-kubernetes-operator, is archived. Note the MongoDBCommunity limitation below before switching, then follow MongoDB's migration guide.

The runtime configuration matches upstream: the same entrypoint, the same container=oci environment, the same / working directory, and the same 2000 user that the chart's default operator.podSecurityContext also pins.

Upstream installs the operator at /usr/local/bin/mongodb-kubernetes-operator, and the official Helm chart hardcodes that path as the container command. Our package installs the binary under /usr/bin, so the image publishes the upstream path as a symlink onto it, which keeps a default helm install working unchanged.

The Ops Manager to MongoDB Agent version mapping ships at /usr/local/om_version_mapping.json, the path the operator reads by default, so Ops Manager reconciles resolve agent versions without extra configuration.

Like upstream, the entrypoint is a shell-form exec of the operator, so the image ignores any command appended to docker run. Unlike upstream, which is built on UBI, this image ships only the operator and bash, so it has no shell utilities beyond bash builtins. Use the -dev variant if you need a fuller toolset for debugging.

MongoDBCommunity Resources Are Not Supported in FIPS Mode

MongoDBCommunity resources that declare users cannot be reconciled by this variant. The community controller always derives SCRAM-SHA-1 credentials alongside SCRAM-SHA-256 for every user, regardless of the auth modes requested in spec.security.authentication.modes, and HMAC-SHA-1 is rejected in FIPS 140 mode. The reconcile panics with crypto/hmac: use of hash functions other than SHA-2 or SHA-3 is not allowed in FIPS 140 mode and the resource never progresses.

Everything else works: the operator starts, registers a controller for every watched resource, and serves its admission webhooks. If you need MongoDBCommunity workloads, use the non-FIPS mongodb-kubernetes image instead.

FIPS Support

The mongodb-kubernetes-fips Chainguard Image ships with a validated redistribution of the OpenSSL's FIPS provider module. For more on FIPS support in Chainguard Images, consult the guide on FIPS-enabled Chainguard Images on Chainguard Academy

Prerequisites

A Kubernetes cluster and Helm. The operator builds an in-cluster Kubernetes client at startup and requires NAMESPACE and OPERATOR_NAME, both of which the chart supplies.

Getting Started

Install the operator with the official mongodb-kubernetes chart, pointing it at this image:

helm repo add mongodb https://mongodb.github.io/helm-charts

values.yaml:

registry:
  operator: cgr.dev/ORGANIZATION
operator:
  operator_image_name: mongodb-kubernetes-fips
  version: latest

helm install mongodb-kubernetes mongodb/mongodb-kubernetes \
    --namespace mongodb --create-namespace --values values.yaml

The chart builds the operator image reference as registry.operator/operator.operator_image_name:operator.version, so operator.version needs to name a tag that exists in your organization's repository. It defaults to the upstream operator version, which is a good match when you track the same release; pin it to a specific tag or digest to keep deployments reproducible.

The chart installs the CRDs it ships, creates the operator's RBAC, and runs the operator as uid 2000. Once the deployment is available, the operator registers a controller for each custom resource in operator.watchedResources, creates its own operator-webhook service and the mdbpolicy.mongodb.com validating webhook configuration, and begins reconciling.

Configuration

The operator is configured through the chart rather than through the image. The values that matter most when adopting this image are the registry, image name and version above, plus operator.watchedResources to scope which custom resources it reconciles, and operator.env (prod or dev) to control log verbosity and log format. Given the FIPS limitation above, drop mongodbcommunity from operator.watchedResources if you do not intend to use it. Note that the chart's default registry.pullPolicy is Always, so nodes need pull credentials for cgr.dev. Refer to the chart's values.yaml for the full set.

Documentation and Resources

• MongoDB Controllers for Kubernetes (MCK) GitHub project
• MongoDB Kubernetes Operator documentation
• MongoDB Helm charts

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.