MongoCluster

Scope: namespaced · Backend: MongoDB Controllers for Kubernetes / MCK (type: mck)

Shared MongoDB with per-consumer databases — the same type × mode shape as PostgresCluster. It wraps the MCK operator, emitting a MongoDBCommunity replica set with one shared SCRAM admin user across all logical databases. MongoDB is the required store for LibreChat (ChatUI).

Spec

Field	Type	Description
type	enum mck (default)	Emits MongoDBCommunity
mode	enum managed | adopt | external (required)	Provenance mode
managed	object	Settings when mode: managed
adopt	object	Reference to an existing MongoDBCommunity
external	object	Base MONGO_URI connection secret

adopt

Field	Description
instanceRef	The existing MongoDBCommunity. namespace is optional and may point at another namespace — the service host is built from it
connectionSecretRef	Connection-string Secret (key connectionString.standard); defaults to MCK's <instance>-admin-<user>. namespace defaults to the instance's namespace; a Secret outside this CR's namespace is mirrored here as <name>-adopted-credentials
databases[]	list

managed

Field	Default	Description
members	1	Replica-set size
version	8.0.4	MongoDB server version
storageSize	—	PVC size
storageClass	cluster default	StorageClass
resources	—	CPU/memory
credentialsSecretName	generated	Override the SCRAM password Secret
rotation	—	Rotate the SCRAM password (licensed)

databases[]

Field	Description
name	Logical database name
credentialsSecretName	Materialized MONGO_URI Secret; defaults to <cluster>-<name>-credentials

A ChatUI that references this cluster gets its database even when it is not declared here, with the auto-wiring licence (external clusters included — only the connection Secret is needed); status.databases[].claimedBy shows who uses each. See Databases for workloads that reference a datastore.

Behavior by mode

• managed (type: mck) — ensures the MCK operator (mongodb-kubernetes), provisions the mongodb-kubernetes-appdb SA/Role/RoleBinding in the namespace (MCK's mongod pods need it), generates the SCRAM password Secret, and emits a MongoDBCommunity replica set. Per databases[] entry it materializes a MONGO_URI Secret (shared SCRAM user, authSource=admin, database path rewritten). MongoDB creates databases lazily on first write — no DDL is issued.
• adopt — references an existing MongoDBCommunity — possibly in another namespace (cross-namespace adoption) — reads its connection-string Secret (defaults to MCK's <instance>-admin-<user> convention, next to the instance), derives the per-database MONGO_URI Secrets from it, and never touches its lifecycle.
• external — derives per-database URIs from a supplied base MONGO_URI; no operator installed.

Example — managed

apiVersion: core.navique.com/v1alpha1
kind: MongoCluster
metadata:
  name: forge-mongo
  namespace: forge-data
spec:
  type: mck
  mode: managed
  managed: { members: 1, version: "8.0.4", storageSize: 10Gi }
  databases:
    - { name: LibreChat, credentialsSecretName: librechat-mongo-credentials }

Backups & restore

Set managed.backup (managed mode only) to schedule backups to object storage — the same provider-neutral block as Postgres/ClickHouse (provider: s3 | azure | gcs, destination, credentials, schedule, retentionPolicy).

The operator emits an owned <name>-backup CronJob that runs mongodump (init container) and uploads the gzip archive with rclone — the universal S3/GCS/Azure uploader. Old archives are pruned by age (retentionPolicy). Setting backup.enabled: false deletes the CronJob.

spec:
  type: mck
  mode: managed
  managed:
    storageSize: 10Gi
    backup:
      enabled: true
      provider: gcs
      gcs:
        destinationPath: gs://my-bucket/mongo
        credentialsSecretRef: { name: mongo-backup-gcs }   # key: credentials (SA JSON)
      schedule: "0 0 2 * * *"
      retentionPolicy: "30d"

Restore is a manual runbook — stream an archive back with mongorestore:

rclone copyto DEST:my-bucket/mongo/mongo-<ts>.archive.gz /tmp/dump.archive.gz
mongorestore --uri="$MONGO_URI" --gzip --archive=/tmp/dump.archive.gz --drop

Status

{ phase, host, port (27017), credentialsSecret, databases[]{name, ready, credentialsSecret}, conditions, observedGeneration }. Short name mongo.