From b94c89c670aeb04fb5e29740cddd71fbdf2cd7b4 Mon Sep 17 00:00:00 2001 From: William Trelawny <22324745+williamtrelawny@users.noreply.github.com> Date: Thu, 11 Jun 2026 10:51:39 -0400 Subject: [PATCH 1/2] Update mongo-rs.yaml Add the `backup` and `restore` roles to the mongo `admin` user, allowing it to perform `mongodump` and `mongorestore` operations. --- charts/graylog/templates/custom/mongo-rs.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/graylog/templates/custom/mongo-rs.yaml b/charts/graylog/templates/custom/mongo-rs.yaml index 3ecea65..e5544ee 100644 --- a/charts/graylog/templates/custom/mongo-rs.yaml +++ b/charts/graylog/templates/custom/mongo-rs.yaml @@ -30,6 +30,10 @@ spec: db: admin - name: userAdminAnyDatabase db: admin + - name: backup + db: admin + - name: restore + db: admin scramCredentialsSecretName: {{ include "graylog.mongodb.crName" . | printf "%s-admin" }} - name: {{ include "graylog.mongodb.crUsername" . }} db: {{ include "graylog.mongodb.crDatabase" . }} @@ -69,4 +73,4 @@ spec: resources: requests: storage: {{ .Values.mongodb.persistence.size.logs | default "2G" | quote }} -{{- end }} \ No newline at end of file +{{- end }} From f0f521c868f07f3668ddf497a41b7666cbe9a27d Mon Sep 17 00:00:00 2001 From: Ramon Marquez Date: Thu, 9 Jul 2026 14:05:09 +0200 Subject: [PATCH 2/2] add simple guide for mongo backup/restores --- charts/graylog/README.md | 9 ++++ docs/mongodb-backup-restore.md | 80 ++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+) create mode 100644 docs/mongodb-backup-restore.md diff --git a/charts/graylog/README.md b/charts/graylog/README.md index f87a697..72ff034 100644 --- a/charts/graylog/README.md +++ b/charts/graylog/README.md @@ -26,6 +26,8 @@ Official Helm chart for Graylog. * [Using External Resources](#using-external-resources) * [Managing Secrets Externally](#managing-secrets-externally) * [Bring Your Own MongoDB](#bring-your-own-mongodb) +* [Maintenance](#maintenance) + * [Back Up and Restore MongoDB](#back-up-and-restore-mongodb) * [Uninstall](#uninstall) * [Removing everything](#removing-everything) * [Debugging](#debugging) @@ -427,6 +429,13 @@ helm upgrade --install graylog graylog/graylog --namespace graylog --reuse-value --set global.existingSecretName="" ``` +# Maintenance + +## Back Up and Restore MongoDB + +To take a manual `mongodump` backup of Graylog's MongoDB database and restore it +with `mongorestore`, see [docs/mongodb-backup-restore.md](../../docs/mongodb-backup-restore.md). + # Uninstall ```sh # optional: scale Graylog down to zero diff --git a/docs/mongodb-backup-restore.md b/docs/mongodb-backup-restore.md new file mode 100644 index 0000000..dd83166 --- /dev/null +++ b/docs/mongodb-backup-restore.md @@ -0,0 +1,80 @@ +# Back Up and Restore MongoDB + +This guide walks through taking a manual logical backup of Graylog's MongoDB +database with [`mongodump`](https://www.mongodb.com/docs/database-tools/mongodump/) +and restoring it with [`mongorestore`](https://www.mongodb.com/docs/database-tools/mongorestore/). +It applies to the MongoDB replica set deployed by this chart (the default +[MongoDB Community](https://www.mongodb.com/docs/kubernetes/current/) resource). + +> **Note:** These commands assume a release named `graylog` in the `graylog` +> namespace. Adjust the release name, namespace, and secret name to match your +> deployment. The connection-string secret is named +> `-mongo-rs-admin-admin`. + +## Prerequisites + +- `kubectl` access to the cluster and namespace where Graylog is installed. +- `jq` installed locally (used to decode the connection secret). +- Enough disk space for the dump, both inside the temporary pod and — if you + copy it out — on your local machine. + +## Back up + +1. Build an admin connection URI from the secret the MongoDB operator generates. + This decodes the standard connection string and rewrites it to authenticate + against the `admin` database while targeting the `graylog` database: + + ```sh + MONGO_ADMIN_URI=$(kubectl get secret graylog-mongo-rs-admin-admin -n graylog -o jsonpath='{.data}' \ + | jq -r '.["connectionString.standard"] | @base64d' \ + | sed 's/admin\?/graylog\?authSource=admin\&/g') + ``` + +2. Launch a throwaway pod with the MongoDB shell/tools image, passing the URI in + as an environment variable, and drop into a shell: + + ```sh + kubectl run -i -t mongosh --image=alpine/mongosh -n graylog \ + -e URI="$MONGO_ADMIN_URI" --restart=Never -- ash + ``` + +3. From inside the pod, dump the database to a local directory in the pod: + + ```sh + mongodump --uri "$URI" --out ./mongo-backup + ``` + +### (Optional) Copy the backup to your local machine + +Run this from your local machine while the `mongosh` pod is still running: + +```sh +kubectl exec mongosh -n graylog -- tar cf - /mongo-backup | tar xf - -C . +``` + +## Restore + +Restoring requires an admin connection URI for the **target** deployment +(`$NEW_MONGO_ADMIN_URI`). Build it the same way as the backup URI in step 1, +using the target cluster's secret. + +If the backup directory only exists on your local machine, copy it back into the +pod first (the reverse of the copy-out step): + +```sh +tar cf - ./mongo-backup | kubectl exec -i mongosh -n graylog -- tar xf - -C /mongo-backup +``` + +Then, from inside the `mongosh` pod, restore the `graylog` database: + +```sh +mongorestore --uri "$NEW_MONGO_ADMIN_URI" mongo-backup/graylog +``` + +## Clean up + +Delete the temporary pod when you are done: + +```sh +kubectl delete pod mongosh -n graylog +```