You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Replace the `pbmuser:secretpwd` with the credentials of [the user who owns the pbm process](../install/configure-authentication.md#create-the-pbm-user)
@@ -86,28 +86,28 @@ Specify new values in MongoDB connection URI string as follows:
pbm status --mongodb-uri "mongodb://pbmuser:secretpwd@mongocsvr1:27017,mongocsvr2:27017,mongocsvr3:27017/?replicaSet=configrs&authSource=admin&readConcernLevel=local&w=1"
Note that you must first obtain the ticket for the `pbm` user with the `kinit` command before you start the **pbm-agent**:
139
139
140
-
```{.bash data-prompt="$"}
141
-
$ sudo -u {USER} kinit pbm
140
+
```bash
141
+
sudo -u {USER} kinit pbm
142
142
```
143
143
144
144
Note that the `{USER}` is the user that you will run the `pbm-agent` process.
@@ -147,7 +147,7 @@ Note that the `{USER}` is the user that you will run the `pbm-agent` process.
147
147
148
148
For [authentication and authorization via Native LDAP :octicons-link-external-16:](https://docs.percona.com/percona-server-for-mongodb/latest/authorization.html#authentication-and-authorization-with-direct-binding-to-ldap), you only create roles for LDAP groups in MongoDB as the users are stored and managed on the LDAP server. However, you still define the `$external` database as your authentication source:
Copy file name to clipboardExpand all lines: docs/details/azure.md
+10-10Lines changed: 10 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,32 +26,32 @@ For either method you need a storage account.
26
26
1. Install the [Azure CLI :octicons-link-external-16:](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli). After the installation, the `az` is available for you.
27
27
2. Sign in to Azure CLI:
28
28
29
-
```{.bash data-prompt="$"}
30
-
$ az login
29
+
```bash
30
+
az login
31
31
```
32
32
33
33
3. Create a Resource group if it's not created for you:
34
34
35
-
```{.bash data-prompt="$"}
36
-
$ az group create --name <your-resource-group> --location <your-location>
35
+
```bash
36
+
az group create --name <your-resource-group> --location <your-location>
Copy file name to clipboardExpand all lines: docs/details/oss.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -25,24 +25,24 @@ You can create a bucket via the [Alibaba Cloud Management Console :octicons-link
25
25
1. [Install](https://www.alibabacloud.com/help/en/oss/developer-reference/install-ossutil2#DAS) and configure the Alibaba Cloud OSS client. After the installation, the `ossutil` command line tool is available for you.
26
26
2. Specify the region:
27
27
28
-
```{.bash data-prompt="$"}
29
-
$ ossutil config
28
+
```bash
29
+
ossutil config
30
30
```
31
31
32
32
Press Enter until you see the prompt `Please enter Region [cn-hangzhou]:` and specify the desired region.
33
33
34
34
3. Create a bucket:
35
35
36
-
```{.bash data-prompt="$"}
37
-
$ ossutil mb oss://your-bucket-name
36
+
```bash
37
+
ossutil mb oss://your-bucket-name
38
38
```
39
39
40
40
Replace `your-bucket-name` with the desired name for your bucket.
41
41
42
42
4. Verify that the bucket is created:
43
43
44
-
```{.bash data-prompt="$"}
45
-
$ ossutil ls
44
+
```bash
45
+
ossutil ls
46
46
```
47
47
48
48
After you created a bucket, apply the [necessary permissions](storage-configuration.md#permissions-setup) for the user identified by the access credentials you plan to use with PBM.
After the bucket is created, apply the proper [permissions for PBM to use the bucket](storage-configuration.md#permissions-setup).
@@ -149,5 +150,59 @@ retryer:
149
150
150
151
This upload retry increases the chances of data upload completion in cases of unstable connection.
151
152
153
+
<<<<<<< HEAD
154
+
=======
155
+
## Data upload to storage with self-signed TLS certificates
156
+
157
+
Percona Backup for MongoDB supports data upload to S3-compatible storage service over HTTPS with a self-signed or a private CA certificate. This feature is especially important when you use services like MinIO, Ceph, or internal S3 gateways that don't use certificates signed by public Certificate Authorities (CAs).
158
+
159
+
Providing a whole chain of certificates is recommended to ensure the connection is legit. The `SSL_CERT_FILE` environment variable specifies the path to a custom certificate chain file in PEM-format that PBM uses to validate TLS/SSL connection.
160
+
161
+
### Usage example
162
+
163
+
Let's assume that your custom CA certificate is at `/etc/ssl/minio-ca.crt` path and your S3 endpoint is `https://minio.internal.local:9000`. To use self-issued TLS certificates, do the following:
164
+
165
+
1. Ensure the cert file is in PEM format. Use the following command to check it:
166
+
167
+
```bash
168
+
cat /etc/ssl/minio-ca.crt
169
+
```
170
+
171
+
??? example "Sample output"
172
+
173
+
174
+
```{text .no-copy}
175
+
-----BEGIN CERTIFICATE-----
176
+
MIIC+TCCAeGgAwIBAgIJANH3WljB...
177
+
-----END CERTIFICATE-----
178
+
```
179
+
180
+
2. Set the `SSL_CERT_FILE` environment variable to that file's path on each host where `pbm-agent` and PBM CLI are running:
181
+
182
+
```bash
183
+
export SSL_CERT_FILE=/etc/ssl/minio-ca.crt
184
+
```
185
+
186
+
If this variable isn't set, PBM uses the system root certificates.
187
+
188
+
3. Restart `pbm-agent`:
189
+
190
+
```bash
191
+
sudo systemctl start pbm-agent
192
+
```
193
+
194
+
4. Verify that your custom certificate is recognized. Check PBM logs for successful S3 access.
195
+
196
+
197
+
Alternatively, you can disable the TLS verification of the S3 storage in Percona Backup for MongoDB configuration:
0 commit comments