Skip to content

Commit 4b4e69e

Browse files
lmkerbey-mdblmkerbey-mdb
authored
(DOCSP-46785) Create new resource. (#180)
* (DOCSP-46785) Create new resource. * (DOCSP-46785) Parameters. * (DOCSP-46785) Add to index and ToC. * (DOCSP-46785) Tech review. * (DOCSP-46785) Fixing leftover issues from copy-paste. * (DOCSP-46785) Wording tweak. * (DOCSP-46785) Copy review. * (DOCSP-46785) Copy review pt. 2 * (DOCSP-46785) Formatting fix.
1 parent 87f7cfd commit 4b4e69e

File tree

3 files changed

+267
-1
lines changed

3 files changed

+267
-1
lines changed

‎source/atlasipaccesslist-custom-resource.txt

Lines changed: 261 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,261 @@
1+
.. _atlasipaccesslist-custom-resource:
2+
3+
=====================================
4+
``AtlasIPAccessList`` Custom Resource
5+
=====================================
6+
7+
.. default-domain:: mongodb
8+
9+
.. contents:: On this page
10+
:local:
11+
:backlinks: none
12+
:depth: 2
13+
:class: singlecol
14+
15+
The ``AtlasIPAccessList`` custom resource configures an :ref:`IP
16+
access list <access-list>` for an |service| project. An IP access list
17+
allows you to secure your project using a minimum-access policy.
18+
19+
.. include:: /includes/fact-ak8so-crds.rst
20+
21+
|ak8so| does one of the following actions using the |service|
22+
:oas-atlas-tag:`Project IP Access List API Resource
23+
</Project-IP-Access-List>`:
24+
25+
- Creates a new IP access list.
26+
- Replace an existing IP access list.
27+
28+
Examples
29+
--------
30+
31+
.. _atlasipaccesslist-example-basic:
32+
33+
Basic Example
34+
~~~~~~~~~~~~~
35+
36+
The following example shows an ``AtlasIPAccessList`` custom resource
37+
that permits access to the ``my-project`` project from the following
38+
sources:
39+
40+
- CIDR block ``192.168.1.0/24``
41+
- IP address ``10.0.0.1``
42+
- :aws:`AWS security group
43+
<vpc/latest/userguide/vpc-security-groups>`
44+
45+
Access from ``10.0.0.1`` expires after the 31st of March, 2025.
46+
47+
.. code-block::
48+
49+
apiVersion: atlas.mongodb.com/v1
50+
kind: AtlasIPAccessList
51+
metadata:
52+
name: atlasipaccesslist-sample
53+
spec:
54+
projectRef:
55+
name: my-project
56+
namespace: my-operator-namespace
57+
entries:
58+
- cidrBlock: 192.168.1.0/24
59+
- ipAddress: 10.0.0.1
60+
deleteAfterDate: 2025-03-31T23:59:59+02:00
61+
- awsSecurityGroup: sg-1234
62+
comment: "AWS Access to my network peering"
63+
64+
Independent CRD Example
65+
~~~~~~~~~~~~~~~~~~~~~~~
66+
67+
The following example shows an ``AtlasIPAccessList`` :ref:`independent
68+
CRD <ak8so-independent-crd>` that permits access from the same CIDR
69+
block and IP address permitted by the :ref:`Basic Example
70+
<atlasipaccesslist-example-basic>`. This custom resource definition
71+
allows you to create an IP access list in a project you manage
72+
outside the instance of |ak8so| with which you define this
73+
resource. To enable independent operation, you must use an
74+
``externalProjectRef`` instead of a ``projectRef``, and you must
75+
supply a ``connectionSecret`` directly since this resource can't
76+
inherit API credentials from its parent project.
77+
78+
.. code-block::
79+
80+
apiVersion: atlas.mongodb.com/v1
81+
kind: AtlasIPAccessList
82+
metadata:
83+
name: atlasipaccesslist-sample
84+
spec:
85+
externalProjectRef:
86+
projectId: 66e2f2b621571b7e69a89b66
87+
connectionSecret:
88+
name: atlas-connection-secret
89+
entries:
90+
- cidrBlock: 192.168.1.0/24
91+
- ipAddress: 10.0.0.1
92+
deleteAfterDate: 2025-03-31T23:59:59+02:00
93+
- awsSecurityGroup: sg-1234
94+
comment: "AWS Access to my network peering"
95+
96+
Parameters
97+
----------
98+
99+
This section describes the ``AtlasIPAccessList`` custom resource parameters available.
100+
101+
.. setting:: metadata.name
102+
103+
*Type*: string
104+
105+
*Required*
106+
107+
Name that the :ref:`atlasipaccesslist-custom-resource` uses to add
108+
this IP access list to a project.
109+
110+
.. setting:: metadata.namespace
111+
112+
*Type*: string
113+
114+
*Optional*
115+
116+
Namespace other than ``default`` that you want to contain the
117+
``atlasIPAccessList`` custom resource.
118+
119+
.. setting:: spec.connectionSecret.name
120+
121+
*Type*: string
122+
123+
*Conditional*
124+
125+
Name of the opaque |k8s-secret| that contains the organization ID
126+
and :ref:`API keys <about-org-api-keys>` that |ak8so| uses to
127+
:ref:`connect <ak8so-access-to-atlas-ref>` to |service|. If
128+
unspecified, |ak8so| defaults to one of the following options:
129+
130+
- The ``spec.connectionSecretRef.name`` parameter of the parent
131+
``atlasProject``
132+
- The default ``global`` secret, if ``spec.connectionSecretRef.name``
133+
is undefined for the parent ``atlasProject``
134+
135+
This parameter is required for :ref:`independent CRDs
136+
<ak8so-independent-crd>`.
137+
138+
.. include:: /includes/fact-ak8so-label-secret.rst
139+
140+
.. setting:: spec.entries
141+
142+
*Type*: array
143+
144+
*Required*
145+
146+
Set of connection sources from which to permit access to the
147+
project.
148+
149+
.. setting:: spec.entries.[n].awsSecurityGroup
150+
151+
*Type*: string
152+
153+
*Conditional*
154+
155+
Unique identifier of the :aws:`AWS security group
156+
<vpc/latest/userguide/vpc-security-groups>` from which to grant
157+
access to the project.
158+
159+
Each entry in ``spec.entries`` must have one and only one of
160+
``awsSecurityGroup``, ``cidrBlock``, or ``ipAddress``.
161+
162+
.. setting:: spec.entries.[n].cidrBlock
163+
164+
*Type*: string
165+
166+
*Conditional*
167+
168+
Range of IP addresses in CIDR block notation from which to grant
169+
access to the project.
170+
171+
Each entry in ``spec.entries`` must have one and only one of
172+
``awsSecurityGroup``, ``cidrBlock``, or ``ipAddress``.
173+
174+
.. setting:: spec.entries.[n].comment
175+
176+
*Type*: string
177+
178+
*Optional*
179+
180+
Comment associated with this access list entry.
181+
182+
.. setting:: spec.entries.[n].deleteAfterDate
183+
184+
*Type*: string
185+
186+
*Optional*
187+
188+
Date and time after which |service| deletes the temporary access
189+
list entry.
190+
191+
To create a permanent access list entry, omit this parameter.
192+
193+
.. setting:: spec.entries.[n].ipAddress
194+
195+
*Type*: string
196+
197+
*Optional*
198+
199+
Single IP address from which to grant access to the project.
200+
201+
Each entry in ``spec.entries`` must have one and only one of
202+
``awsSecurityGroup``, ``cidrBlock``, or ``ipAddress``.
203+
204+
.. setting:: spec.externalProjectRef.id
205+
206+
*Type*: string
207+
208+
*Conditional*
209+
210+
ID of the project to which the IP access list belongs. You must
211+
specify the project ID of an existing :ref:`Atlas Project
212+
<manage-projects>`. This parameter is required for IP access lists
213+
that belong to projects managed by either:
214+
215+
- A different instance of |ak8so|
216+
- Tooling other than |ak8so|
217+
218+
For deployments that belong to projects managed by
219+
the same instance of |ak8so|, use ``spec.projectRef.name`` if you
220+
do not use ``spec.externalProjectRef.id``.
221+
222+
An IP access list can belong to only one project. To define the
223+
same IP access list for multiple projects, create custom resource
224+
definitions for each project.
225+
226+
.. setting:: spec.projectRef.name
227+
228+
*Type*: string
229+
230+
*Conditional*
231+
232+
Name of the project to which the IP access list belongs. You must
233+
specify an existing :ref:`atlasproject-custom-resource`. This
234+
parameter applies only to IP access lists that belong to projects
235+
managed by the same instance |ak8so|.
236+
237+
For deployments that belong to projects managed by either:
238+
239+
- a different instance of |ak8so|
240+
- tooling other than |ak8so|
241+
242+
use ``spec.externalProjectRef.id``.
243+
244+
An IP access list can belong only to one project. To define the
245+
same IP access list for multiple projects, create custom resource
246+
definitions for each project.
247+
248+
.. setting:: spec.projectRef.namespace
249+
250+
*Type*: string
251+
252+
*Conditional*
253+
254+
Namespace in which the :ref:`atlasproject-custom-resource`
255+
specified in ``spec.projectRef.name`` exists.
256+
257+
Do not set this parameter for deployments that belong to projects
258+
managed by either:
259+
260+
- a different instance of |ak8so|
261+
- tooling other than |ak8so|

‎source/atlasprivateendpoint-custom-resource.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ inherit API credentials from its parent project.
8282
spec:
8383
atlasRef:
8484
projectID: 66e2f2b621571b7e69a89b66
85-
credentials:
85+
connectionSecret:
8686
name: atlas-connection-secret
8787
provider: AWS
8888
region: us-east-1

‎source/custom-resources.txt

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,10 @@ Custom Resources
5050
|service|.
5151
- adu
5252

53+
* - :ref:`atlasipaccesslist-custom-resource`
54+
- List of permitted sources for connections to |service|.
55+
- aal
56+
5357
* - :ref:`atlasproject-custom-resource`
5458
- Project in |service|.
5559
- ap
@@ -241,6 +245,7 @@ of |ak8so|.
241245
AtlasBackupPolicy </atlasbackuppolicy-custom-resource>
242246
AtlasBackupSchedule </atlasbackupschedule-custom-resource>
243247
AtlasBackupCompliancePolicy </bcp-custom-resource>
248+
AtlasIPAccessList </atlasipaccesslist-custom-resource>
244249
AtlasPrivateEndpoint </atlasprivateendpoint-custom-resource>
245250
AtlasTeam </atlasteam-custom-resource>
246251
AtlasDataFederation </atlasdatafederation-custom-resource>

0 commit comments

Comments
 (0)