A Free New World: Atlas Free Tier and How It Was Born

#MDBW17
Atlas Free Tier and How It Was Born
A FREE NEW WORLD

#MDBW17
LOUISA BERGER
Lead Engineer, Automation

#MDBW17
AGENDA
Introduction Atlas Free Tier Atlas Proxy QA
Your chance!
1 2 3 4

#MDBW17
VINCENT DO
Fullstack Engineer, Atlas

#MDBW17
BYOH - BRING YOUR OWN HARDWARE

#MDBW17
“Great! How do I try it for free???”

#MDBW17
FREE TIER ADOPTION
0
5000
10000
15000
20000
25000
February March April May
Free clusters
~20000

#MDBW17
free0.mongodb.net free1.mongodb.net free2.mongodb.net

#MDBW17
FreeCluster0 FreeCluster1 FreeCluster2
Firewall

#MDBW17
Firewall

#MDBW17
aws1.mongodb.netaws0.mongodb.net aws2.mongodb.net
CNAME CNAME CNAME

#MDBW17
CNAME
aws1.mongodb.netaws0.mongodb.net aws2.mongodb.net

#MDBW17

#MDBW17
a

#MDBW17
FREE TIER PROXY
• Creates a multi-tenant MongoDB
• Layer between user account and backing mongo
• Manages resource sharing across the replica set
How do we create a multi-tenant MongoDB?

#MDBW17
Challenge: Multiple accounts want to have an ‘accounts’ database
BUILDING A MULTI-TENANT MONGOD:
1. DATA MANAGEMENT

#MDBW17
Challenge: Multiple accounts want to have an ‘accounts’ database
Solution: Database Prefixing
1. DATA MANAGEMENT

#MDBW17
DATABASE PREFIXING
User
123
User
456

#MDBW17
DATABASE PREFIXING
{ db.students.insert(
{ “name”: “James”,
“pw” : “abc”}
)}
User
123
{ “name”: “Katie”,
“pw” : “def”}
)}
User
456

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
DB: accounts
“user” :
“James”,
“pwd” : “abc”
}
{
“name” : “James”,
}
{
“name” : “Katie”,
“pwd” : “def”
}

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
DB: accounts
DB: accounts
“user” :
“James”,
}
{
}
{
}

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
Proxy

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
DB: 123-accounts
Proxy
“user” :
“James”,
}

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
DB: 123-accounts
Proxy
“user” :
“James”,
}
{
}

#MDBW17
DATABASE PREFIXING
“pw” : “abc”}
)}
User
123
“pw” : “def”}
)}
User
456
DB: 123-accounts
DB: 456-accounts
Proxy
“user” :
“James”,
}
{
}
{
}

#MDBW17
DATABASE PREFIXING
{ db.students.find()}User
456 Proxy
DB: 123-accounts
DB: 456-accounts
“user” :
“James”,
}
{
}
{
}

#MDBW17
DATABASE PREFIXING
1.Run command on prefixed-database
>db.runCommand(
{renameCollection:
"users.students",
to: "users."});
Proxy Mongo
User
123
>db.runCommand(
{renameCollection:
“users.students", to:
“users."});
db : accounts db : 123-accounts

#MDBW17
DATABASE PREFIXING
2. Translate command parameters
>db.runCommand(
{renameCollection:
"users.students",
to: ”accounts."});
Proxy Mongo
User
123
>db.runCommand(
{renameCollection:
"123-accounts.students",
to: "123-accounts."});
db : accounts db : 123-accounts

#MDBW17
DATABASE PREFIXING
3. Translate responses
Proxy Mongo
User
123
> {
"ok" : 0,
"errmsg" : "invalid
collection name:
123-accounts."
}
> {
"ok" : 0,
"errmsg" : "invalid
collection name:
accounts."
}

#MDBW17
DATABASE PREFIXING
>db.runCommand(
{renameCollection:
”accounts.students",
to: ”accounts."});
Proxy Mongo
User
123
Proxy Mongo
User
123
>db.runCommand(
{renameCollection:
"123-accounts.students",
to: "123-accounts."});
> {
"ok" : 0,
"errmsg" :
"invalid
collection name:
123-accounts."
}
> {
"ok" : 0,
"errmsg" :
"invalid
collection name:
accounts."
}

#MDBW17
Challenge: How do we stop one user from using up all the
resources in the shared replica set?
2. RESOURCE LIMITS

#MDBW17
Challenge: How do we stop one user from using up all the
resources in the shared replica set?
Solution: Limit resources available to each user.
2. RESOURCE LIMITS

#MDBW17
• Connections: 100
• Disk Space: 512 MB
• Collections: 500
• Databases: 100
• Operations: 100/second
2. RESOURCE LIMITS

#MDBW17
• Connections: 100
• Disk Space: 512 MB
• Collections: 500
• Databases: 100
• Operations: 100/second
2. RESOURCE LIMITS
→ Keep internal stats on
user operations.
→ Check stats before
running operation.

#MDBW17
Challenge: How do we isolate meta-information about each user?
3. SPECIAL DB HANDLING

#MDBW17
Challenge: How do we isolate meta-information about each user?
Solution: Utilize Mongo query filters and authorization.

#MDBW17
Example: Tailing the oplog
> use local;
> db.oplog.rs.find()
operation 1
operation 2
operation 3
operation 4
operation 5
operation 6

#MDBW17
operation 1
operation 2
operation 3
operation 4
operation 5
operation 6
> use local;
> db.oplog.rs.find({“ns” : “/^123/”})

#MDBW17
> use local;
> db.oplog.rs.find({“ns” : “/^123/”})
operation 1
operation 2
operation 3
operation 4
operation 5
operation 6

#MDBW17
Challenge: How do we keep users from accessing each other’s
data?
4. AUTHORIZATION

#MDBW17
Challenge: How do we keep users from accessing each other’s
data?
Solution: Re-implement MongoDB user auth in the proxy level
4. AUTHORIZATION

#MDBW17
• Exclusively add users through the Atlas UI.
• Users are stored in a proxy config file created by Atlas.
• User management commands blocked in the proxy.
4. AUTHORIZATION

#MDBW17
• Proxy has re-implementations of MongoDB command
authorization
• Looks like regular MongoDB authorization to customers
4. AUTHORIZATION
> db.bar.find()
> { "errmsg" : "user is not allowed to do action
[find] on [foo.]", "ok" : 0 }

#MDBW17
FUTURE PLANS
• Ability to convert Free Tier clusters to higher tiers
• Use proxies for higher tiers to keep costs low

A Free New World: Atlas Free Tier and How It Was Born

A Free New World: Atlas Free Tier and How It Was Born

Related slideshows

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

Recommended for you

More Related Content

What's hot

What's hot (20)

Similar to A Free New World: Atlas Free Tier and How It Was Born

Similar to A Free New World: Atlas Free Tier and How It Was Born (20)

More from MongoDB

More from MongoDB (20)

Recently uploaded

Recently uploaded (20)

A Free New World: Atlas Free Tier and How It Was Born