Amazon DocumentDB

August 6, 2026 · View on GitHub

Amazon DocumentDB is a managed, MongoDB compatible database. It can be used as the metadata store for Kerberos Hub instead of a self-hosted MongoDB.

Things to know

  • Not reachable from outside its VPC. DocumentDB has no public endpoint, so the Kerberos Hub services must run inside (or be peered with) the same VPC.
  • TLS is enabled by default. Clients must trust the Amazon RDS certificate authority bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem.
  • Not every MongoDB feature is available. Retryable writes, the MongoDB Stable API, geospatial queries/indexes and complex $lookup pipelines are unsupported. Set mongodb.flavor: "documentdb" and mongodb.retryWrites: "false" in the hub chart so those code paths are disabled.

Provisioning

The amazon-eks-documentdb Terraform stack creates a VPC, an EKS cluster and a DocumentDB cluster with TLS enforced, and outputs a ready to paste mongodb values block for the hub helm chart.

Connecting Kerberos Hub

Configure the database through mongodb.uri (not mongodb.host) and point the chart at the CA bundle:

curl -O https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem
kubectl create secret generic mongodb-ca --from-file=global-bundle.pem -n kerberos-hub

mongodb:
  flavor: "documentdb"
  retryWrites: "false"
  uri: "mongodb://<user>:<password>@<cluster>.docdb.amazonaws.com:27017/?replicaSet=rs0&readPreference=secondaryPreferred&retryWrites=false"
  adminDatabase: "admin"
  authenticationMechanism: "SCRAM-SHA-1"
  tls:
    enabled: true
    existingSecret: "mongodb-ca"
    caFileName: "global-bundle.pem"
    mountPath: "/certs"

The chart mounts the bundle read-only into every workload that talks to MongoDB and appends tls=true&tlsCAFile=/certs/global-bundle.pem to the connection string.