feat(helm): add support for mongodb operator

.gitignore

@@ -43,6 +43,9 @@ utils/observability/tempo-data/*
 # Ignore the mongo data backup directory for Mongo to PG migrations
 mongo-data**
 
+# ignore local mongodb data/binary artifacts developers create during local testing
+mongodb*
+!deploy/helm/**/mongodb*
+
 # ignore the task file as it will be different for different project implementations.
-TASKS.md
-mongodb*
+TASKS.md

deploy/helm/Chart.yaml

@@ -11,7 +11,7 @@ sources:
   - https://github.com/appsmithorg/appsmith
 home: https://www.appsmith.com/
 icon: https://assets.appsmith.com/appsmith-icon.png
-version: 3.6.10
+version: 3.7.0
 dependencies:
   - condition: redis.enabled
     name: redis
@@ -33,3 +33,8 @@ dependencies:
     version: 25.27.0
     appVersion: 2.54.1
     repository: https://prometheus-community.github.io/helm-charts
+  - condition: mongodbOperator.enabled
+    alias: mongodbOperator
+    name: mongodb-kubernetes
+    version: 1.8.0
+    repository: https://mongodb.github.io/helm-charts

deploy/helm/README.md

@@ -153,6 +153,53 @@ The command uninstalls the release and removes all Kubernetes resources associat
 | `storageClass.mountOptions`					| Mount options used by Persistent Volumes															| `{}`								|
 | `storageClass.parameters`						| Storage Class parameters																							| `{}`								|
 
+### MongoDB Community Operator parameters
+
+> **Preview feature in 3.7.0** — pilot before relying on it for production data. See [docs/install-mongodb-operator.md](docs/install-mongodb-operator.md) for known limitations.
+
+The chart can deploy MongoDB via the [MongoDB Kubernetes Operator](https://github.com/mongodb/mongodb-kubernetes) instead of the default Bitnami MongoDB subchart. Set `mongodbOperator.enabled=true` to bundle the operator as a subchart.
+
+Quickstart for a fresh install:
+
+```bash
+kubectl create namespace appsmith
+helm install appsmith appsmith/appsmith -n appsmith \
+  --set mongodb.enabled=false \
+  --set mongodbCommunity.enabled=true \
+  --set mongodbOperator.enabled=true
+```
+
+See [docs/install-mongodb-operator.md](docs/install-mongodb-operator.md) for the full guide.
+
+When `mongodbCommunity.enabled=true` and `auth.passwordSecretName` is empty, a pre-install Job generates a random password into a Secret named `{name}-password`. The Job is idempotent and compatible with ArgoCD.
+
+#### Subchart values (`mongodbOperator.*`)
+
+| Name | Description | Value |
+|---|---|---|
+| `mongodbOperator.enabled` | Install the upstream MongoDB Kubernetes Operator subchart alongside this chart | `false` |
+
+Other `mongodbOperator.*` values pass through to the upstream [mongodb-kubernetes](https://github.com/mongodb/mongodb-kubernetes) chart. Common overrides include `mongodbOperator.operator.watchNamespace` and `mongodbOperator.registry.*` — see the upstream chart's values reference.
+
+#### MongoDBCommunity CR values (`mongodbCommunity.*`)
+
+| Name                                       | Description                                                                                                                    | Value              |
+| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ | ------------------ |
+| `mongodbCommunity.enabled`                 | Deploy a `MongoDBCommunity` custom resource                                                                                    | `false`            |
+| `mongodbCommunity.name`                    | Name of the `MongoDBCommunity` custom resource. When empty, defaults to `<release-fullname>-mongo`.                            | `""`               |
+| `mongodbCommunity.version`                 | MongoDB version to deploy                                                                                                      | `8.0.20`           |
+| `mongodbCommunity.members`                 | Number of replica set members. `1` is a dev-friendly default; set to `3` for production HA.                                    | `1`                |
+| `mongodbCommunity.replicaSetName`          | Name of the MongoDB replica set                                                                                                | `appsmith-mongodb` |
+| `mongodbCommunity.auth.username`           | MongoDB user for Appsmith                                                                                                      | `appsmith`         |
+| `mongodbCommunity.auth.database`           | Authentication database (also used as connection path)                                                                         | `appsmith`         |
+| `mongodbCommunity.auth.passwordSecretName` | Name of an existing Secret containing the password (key: `password`). When empty, a pre-install Job autogenerates the Secret. | `""`               |
+| `mongodbCommunity.persistent.storageSize`  | Storage size for each MongoDB replica PVC                                                                                      | `10Gi`             |
+| `mongodbCommunity.persistent.storageClass` | StorageClass for MongoDB PVCs. Empty uses cluster default (or `global.storageClass`).                                          | `""`               |
+| `mongodbCommunity.resources`               | Resource requests/limits for MongoDB containers                                                                                | `{}`               |
+| `mongodbCommunity.nodeSelector`            | Node selector for MongoDB pods                                                                                                 | `{}`               |
+| `mongodbCommunity.affinity`                | Affinity rules for MongoDB pods                                                                                                | `{}`               |
+| `mongodbCommunity.tolerations`             | Tolerations for MongoDB pods                                                                                                   | `[]`               |
+
 ### Auto update chart's image
 | Name										| Description																		|	Value					|
 | -----------------------	|	--------------------------------------------- | -------------	|

deploy/helm/docs/install-mongodb-operator.md

@@ -0,0 +1,273 @@
+# Install Appsmith with the MongoDB Kubernetes Operator
+
+> **Preview feature in chart 3.7.0.** This path installs and runs, but migration from an existing Bitnami-backed Appsmith release to the operator-managed path isn't fully documented yet. Pilot this path before relying on it for production data.
+
+This guide installs Appsmith with MongoDB managed by the [MongoDB Kubernetes Operator](https://github.com/mongodb/mongodb-kubernetes) instead of the default Bitnami MongoDB subchart.
+
+## Why use the operator
+
+- MongoDB pods are managed by a dedicated controller that handles replica set membership, TLS/SCRAM credential lifecycle, and version upgrades
+- The controller creates and maintains the connection-string secret that Appsmith consumes — no manual URL assembly
+- Stays on supported, actively maintained MongoDB images (the Bitnami `mongodb` image has been deprecated by its publisher)
+
+## What this chart does
+
+When `mongodbCommunity.enabled: true`, the chart:
+
+- Renders a `MongoDBCommunity` custom resource that the operator reconciles into a replica set
+- Runs a one-time, idempotent pre-install Job that generates a random password and stores it in a Kubernetes Secret (unless you supply your own)
+- Wires the Appsmith workload to read MongoDB's connection string from the operator-managed secret
+
+When `mongodbOperator.enabled: true` (recommended for new installs), the chart also pulls the upstream `mongodb-kubernetes` chart as a subchart, which installs the operator pod and the required CRDs.
+
+---
+
+## Prerequisites
+
+1. Kubernetes 1.28+
+2. [Helm 3.14+](https://helm.sh/docs/intro/install/)
+3. `kubectl` configured for the target cluster
+4. A default `StorageClass` (or one you'll pass explicitly via `--set global.storageClass=<name>`)
+
+No separate operator install is required — the chart can bundle it (see below).
+
+---
+
+## Quickstart — fresh install with bundled operator
+
+```bash
+helm repo add appsmith https://helm.appsmith.com
+helm repo update
+
+kubectl create namespace appsmith
+
+helm install appsmith appsmith/appsmith -n appsmith --wait --timeout 10m \
+  --set mongodb.enabled=false \
+  --set mongodbCommunity.enabled=true \
+  --set mongodbOperator.enabled=true
+```
+
+Explanation:
+
+| Flag | Purpose |
+|---|---|
+| `mongodb.enabled=false` | Don't deploy the default Bitnami MongoDB subchart |
+| `mongodbCommunity.enabled=true` | Deploy a `MongoDBCommunity` CR for the operator to reconcile |
+| `mongodbOperator.enabled=true` | Install the upstream MongoDB Kubernetes Operator subchart in the same namespace |
+
+### Verify the install
+
+```bash
+kubectl get pods -n appsmith
+kubectl get mongodbcommunity -n appsmith
+```
+
+Expected output (abridged):
+
+```
+NAME                              READY   STATUS
+appsmith-0                        1/1     Running
+appsmith-mongo-0                  2/2     Running
+appsmith-postgresql-0             1/1     Running
+appsmith-redis-master-0           1/1     Running
+mongodb-kubernetes-operator-...   1/1     Running
+
+NAME             PHASE     VERSION
+appsmith-mongo   Running   8.0.20
+```
+
+### Access the UI
+
+```bash
+kubectl port-forward -n appsmith svc/appsmith 8080:80
+```
+
+Open http://localhost:8080.
+
+For production access, configure an Ingress — see [exposing Appsmith online](https://docs.appsmith.com/getting-started/setup/installation-guides/kubernetes/publish-appsmith-online).
+
+---
+
+## Retrieving the generated MongoDB password
+
+The MongoDB user password is in a Secret named `<mongodbCommunity.name>-password` — for a release named `appsmith` with default naming, that's `appsmith-mongo-password`:
+
+```bash
+kubectl get secret appsmith-mongo-password -n appsmith \
+  -o jsonpath='{.data.password}' | base64 -d
+```
+
+Appsmith itself reads its connection string from an operator-managed Secret:
+
+```bash
+kubectl get secret appsmith-mongo-appsmith-appsmith -n appsmith \
+  -o jsonpath='{.data.connectionString\.standardSrv}' | base64 -d
+```
+
+---
+
+## Common configuration
+
+### Bring your own MongoDB password Secret
+
+If you manage secrets externally (Vault, SOPS, ExternalSecrets, etc.), create the Secret yourself and point the chart at it via `mongodbCommunity.auth.passwordSecretName`. The Secret must contain a single key named `password` holding the plaintext password — the example below uses `kubectl create secret` to show the required format, but you can produce the same shape through whatever tooling you already use.
+
+```bash
+kubectl create secret generic my-mongodb-secret \
+  -n appsmith \
+  --from-literal=password='<your-password>'
+
+helm install appsmith appsmith/appsmith -n appsmith --wait --timeout 10m \
+  --set mongodb.enabled=false \
+  --set mongodbCommunity.enabled=true \
+  --set mongodbOperator.enabled=true \
+  --set mongodbCommunity.auth.passwordSecretName=my-mongodb-secret
+```
+
+When `mongodbCommunity.auth.passwordSecretName` is set, the chart skips the pre-install Job and assumes the Secret is correctly populated.
+
+### Resource sizing and HA
+
+The chart's defaults are tuned for evaluation and dev: a single-member replica set with modest storage. MongoDB is fully functional in this mode but has no failover.
+
+For production, scale to three members, pin resources, and set an explicit `StorageClass`:
+
+```yaml
+mongodbCommunity:
+  enabled: true
+  members: 3                         # replica set size (odd number recommended)
+  persistent:
+    storageSize: 100Gi
+    storageClass: gp3                # or omit to use cluster default
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      memory: 4Gi
+```
+
+Scaling from 1 to 3 after the fact is a value change on upgrade — the operator handles adding members to the replica set without downtime.
+
+---
+
+## Deploying with ArgoCD
+
+The bundled operator path works cleanly with ArgoCD because the CRDs live in the upstream chart's `crds/` directory — Helm (and ArgoCD) install them before any templates are validated.
+
+Example `Application`:
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: appsmith
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://helm.appsmith.com
+    chart: appsmith
+    targetRevision: <chart-version>
+    helm:
+      valuesObject:
+        mongodb:
+          enabled: false
+        mongodbCommunity:
+          enabled: true
+        mongodbOperator:
+          enabled: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: appsmith
+  syncPolicy:
+    automated: {}
+    syncOptions:
+      - CreateNamespace=true
+```
+
+---
+
+## Uninstall
+
+Delete the `MongoDBCommunity` resource first so the operator can finish processing its finalizer while it's still running. Then uninstall the release and remove the namespace:
+
+```bash
+# 1. Delete the CR and wait for the operator to clear its finalizer
+kubectl delete mongodbcommunity -n appsmith --all --wait=true
+
+# 2. Uninstall Appsmith (and the bundled operator, if enabled)
+helm uninstall appsmith -n appsmith
+
+# 3. Remove the namespace
+kubectl delete namespace appsmith
+```
+
+Skipping step 1 can leave the `MongoDBCommunity` resource stuck with an unresolved finalizer once the operator Deployment is gone, which blocks namespace deletion. If that happens, see the [troubleshooting section](#namespace-deletion-hangs-after-helm-uninstall).
+
+This removes Appsmith, the bundled operator (if installed via this chart), and all operator-reconciled resources tied to its `MongoDBCommunity` CR.
+
+The MongoDB CRDs installed by the subchart persist after uninstall (Helm never removes resources from `crds/`). To fully clean up:
+
+```bash
+kubectl delete crd mongodbcommunity.mongodbcommunity.mongodb.com
+# The mongodb-kubernetes chart also installs CRDs for its enterprise features:
+kubectl delete crd mongodb.mongodb.com
+kubectl delete crd mongodbusers.mongodb.com
+# (and any others from the chart you want to remove)
+```
+
+**Warning**: deleting these CRDs removes all matching resources across the cluster — only do this if nothing else relies on the operator.
+
+---
+
+## Troubleshooting
+
+### `MongoDBCommunity` CR stays in `Pending` phase
+
+**Check**: operator logs
+
+```bash
+kubectl logs -n appsmith -l app.kubernetes.io/name=mongodb-kubernetes-operator --tail=50
+```
+
+Common causes:
+- The password Secret doesn't exist. If you set `mongodbCommunity.auth.passwordSecretName`, verify the Secret exists and has a `password` key.
+- The MongoDB image can't be pulled. Check `kubectl describe pod <mongodbCommunity.name>-0` for image-pull errors.
+
+### Namespace deletion hangs after `helm uninstall`
+
+**Symptom**: `kubectl delete namespace appsmith` never completes after uninstalling the release. The `MongoDBCommunity` resource is still listed with a `deletionTimestamp` set.
+
+**Cause**: the `MongoDBCommunity` CR has a finalizer that the operator is responsible for removing. When `mongodbOperator.enabled=true`, Helm may tear down the operator Deployment before the operator finishes processing the CR's deletion, leaving the finalizer in place forever.
+
+**Fix**: clear the finalizer manually, then the namespace deletion proceeds:
+
+```bash
+kubectl patch mongodbcommunity -n appsmith <mongodbCommunity.name> \
+  --type=merge -p '{"metadata":{"finalizers":[]}}'
+```
+
+### Appsmith pod stuck in `Init`
+
+**Cause**: the Appsmith init container waits for MongoDB to be reachable. If MongoDB isn't ready, this container keeps retrying.
+
+**Fix**: check MongoDB first (`kubectl get mongodbcommunity -n appsmith`). If the phase is `Running` but Appsmith still won't progress, check the init container logs:
+
+```bash
+kubectl logs -n appsmith appsmith-0 -c mongo-init-container
+```
+
+### Password init Job fails with image pull error
+
+**Symptom**: `<mongodbCommunity.name>-password-init` Job pod is in `ImagePullBackOff` for `alpine/kubectl`.
+
+**Cause**: the cluster cannot pull `docker.io/alpine/kubectl` — either the registry is unreachable (air-gapped) or policy blocks pulls from Docker Hub.
+
+**Fix**: override the image to point at your registry:
+
+```bash
+--set mongodbCommunity.passwordInit.image.registry=my-registry.example.com
+--set mongodbCommunity.passwordInit.image.repository=my/kubectl
+--set mongodbCommunity.passwordInit.image.tag=1.34.2
+```

deploy/helm/templates/NOTES.txt

@@ -28,3 +28,28 @@ Please update your DNS records with your domain by the address. You can use foll
 
 To expose your Appsmith service to be accessible from the Internet, please refer to our docs here https://docs.appsmith.com/getting-started/setup/installation-guides/kubernetes/publish-appsmith-online.
 {{- end }}
+
+{{- if .Values.mongodbCommunity.enabled }}
+
+2. MongoDB Community Operator:
+
+  CR Name:           {{ include "appsmith.mongoCommunityName" . }}
+  MongoDB Version:   {{ .Values.mongodbCommunity.version }}
+  Members:           {{ .Values.mongodbCommunity.members }}
+  Service:           {{ include "appsmith.mongoOperatorServiceName" . }}.{{ .Release.Namespace }}.svc.cluster.local
+  Connection Secret: {{ include "appsmith.mongoOperatorSecretName" . }}
+
+  To retrieve the connection string:
+    kubectl get secret {{ include "appsmith.mongoOperatorSecretName" . }} -n {{ .Release.Namespace }} -o jsonpath='{.data.connectionString\.standardSrv}' | base64 -d
+
+{{- if .Values.mongodb.enabled }}
+
+  TRANSITION MODE: Both Bitnami MongoDB and Operator-managed MongoDB are running.
+  Appsmith is currently connected to the Bitnami MongoDB instance.
+
+  To migrate:
+    1. mongodump from the Bitnami instance
+    2. mongorestore into the operator-managed instance
+    3. Set mongodb.enabled=false and run helm upgrade to switch Appsmith to the operator instance
+{{- end }}
+{{- end }}