diff --git a/.evergreen-tasks.yml b/.evergreen-tasks.yml
index b5366b2a0..1d289fa3f 100644
--- a/.evergreen-tasks.yml
+++ b/.evergreen-tasks.yml
@@ -1285,3 +1285,8 @@ tasks:
     tags: ["patch-run"]
     commands:
       - func: "e2e_test"
+
+  - name: e2e_search_community_tls
+    tags: ["patch-run"]
+    commands:
+      - func: "e2e_test"
diff --git a/.evergreen.yml b/.evergreen.yml
index 209bf152a..94bbd5a09 100644
--- a/.evergreen.yml
+++ b/.evergreen.yml
@@ -686,6 +686,7 @@ task_groups:
     tasks:
       - e2e_community_replicaset_scale
       - e2e_search_community_basic
+      - e2e_search_community_tls
 
   # This is the task group that contains all the tests run in the e2e_mdb_kind_ubuntu_cloudqa build variant
   - name: e2e_mdb_kind_cloudqa_task_group
diff --git a/api/v1/search/mongodbsearch_types.go b/api/v1/search/mongodbsearch_types.go
index 43e9be1be..d77fc9b4c 100644
--- a/api/v1/search/mongodbsearch_types.go
+++ b/api/v1/search/mongodbsearch_types.go
@@ -1,6 +1,8 @@
 package search
 
 import (
+	"fmt"
+
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 
@@ -14,8 +16,10 @@ import (
 )
 
 const (
-	MongotDefaultPort        = 27027
-	MongotDefaultMetricsPort = 9946
+	MongotDefaultPort               = 27027
+	MongotDefaultMetricsPort        = 9946
+	MongotDefautHealthCheckPort     = 8080
+	MongotDefaultSyncSourceUsername = "search-sync-source"
 )
 
 func init() {
@@ -23,21 +27,50 @@ func init() {
 }
 
 type MongoDBSearchSpec struct {
+	// Optional version of MongoDB Search component (mongot). If not set, then the operator will set the most appropriate version of MongoDB Search.
 	// +optional
 	Version string `json:"version"`
+	// MongoDB database connection details from which MongoDB Search will synchronize data to build indexes.
 	// +optional
 	Source *MongoDBSource `json:"source"`
+	// StatefulSetSpec which the operator will apply to the MongoDB Search StatefulSet at the end of the reconcile loop. Use to provide necessary customizations,
+	// which aren't exposed as fields in the MongoDBSearch.spec.
 	// +optional
 	StatefulSetConfiguration *common.StatefulSetConfiguration `json:"statefulSet,omitempty"`
+	// Configure MongoDB Search's persistent volume. If not defined, the operator will request 10GB of storage.
 	// +optional
 	Persistence *common.Persistence `json:"persistence,omitempty"`
+	// Configure resource requests and limits for the MongoDB Search pods.
 	// +optional
 	ResourceRequirements *corev1.ResourceRequirements `json:"resourceRequirements,omitempty"`
+	// Configure security settings of the MongoDB Search server that MongoDB database is connecting to when performing search queries.
+	// +optional
+	Security Security `json:"security"`
 }
 
 type MongoDBSource struct {
 	// +optional
 	MongoDBResourceRef *userv1.MongoDBResourceRef `json:"mongodbResourceRef,omitempty"`
+	// +optional
+	PasswordSecretRef *userv1.SecretKeyRef `json:"passwordSecretRef,omitempty"`
+	// +optional
+	Username *string `json:"username,omitempty"`
+}
+
+type Security struct {
+	// +optional
+	TLS TLS `json:"tls"`
+}
+
+type TLS struct {
+	Enabled bool `json:"enabled"`
+	// CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
+	// The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
+	// This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
+	// Alternatively, an entry tls.pem, containing the concatenation of cert and key, can be provided.
+	// If all of tls.pem, tls.crt and tls.key are present, the tls.pem one needs to be equal to the concatenation of tls.crt and tls.key
+	// +optional
+	CertificateKeySecret corev1.LocalObjectReference `json:"certificateKeySecretRef"`
 }
 
 type MongoDBSearchStatus struct {
@@ -105,6 +138,25 @@ func (s *MongoDBSearch) MongotConfigConfigMapNamespacedName() types.NamespacedNa
 	return types.NamespacedName{Name: s.Name + "-search-config", Namespace: s.Namespace}
 }
 
+func (s *MongoDBSearch) SourceUserPasswordSecretRef() *userv1.SecretKeyRef {
+	if s.Spec.Source != nil && s.Spec.Source.PasswordSecretRef != nil {
+		return s.Spec.Source.PasswordSecretRef
+	}
+
+	return &userv1.SecretKeyRef{
+		Name: fmt.Sprintf("%s-%s-password", s.Name, MongotDefaultSyncSourceUsername),
+		Key:  "password",
+	}
+}
+
+func (s *MongoDBSearch) SourceUsername() string {
+	if s.Spec.Source != nil && s.Spec.Source.Username != nil {
+		return *s.Spec.Source.Username
+	}
+
+	return MongotDefaultSyncSourceUsername
+}
+
 func (s *MongoDBSearch) StatefulSetNamespacedName() types.NamespacedName {
 	return types.NamespacedName{Name: s.Name + "-search", Namespace: s.Namespace}
 }
@@ -134,3 +186,18 @@ func (s *MongoDBSearch) GetMongotPort() int32 {
 func (s *MongoDBSearch) GetMongotMetricsPort() int32 {
 	return MongotDefaultMetricsPort
 }
+
+// TLSSecretNamespacedName will get the namespaced name of the Secret containing the server certificate and key
+func (s *MongoDBSearch) TLSSecretNamespacedName() types.NamespacedName {
+	return types.NamespacedName{Name: s.Spec.Security.TLS.CertificateKeySecret.Name, Namespace: s.Namespace}
+}
+
+// TLSOperatorSecretNamespacedName will get the namespaced name of the Secret created by the operator
+// containing the combined certificate and key.
+func (s *MongoDBSearch) TLSOperatorSecretNamespacedName() types.NamespacedName {
+	return types.NamespacedName{Name: s.Name + "-search-certificate-key", Namespace: s.Namespace}
+}
+
+func (s *MongoDBSearch) GetMongotHealthCheckPort() int32 {
+	return MongotDefautHealthCheckPort
+}
diff --git a/api/v1/search/zz_generated.deepcopy.go b/api/v1/search/zz_generated.deepcopy.go
index e9384e3de..8817e4b46 100644
--- a/api/v1/search/zz_generated.deepcopy.go
+++ b/api/v1/search/zz_generated.deepcopy.go
@@ -109,6 +109,7 @@ func (in *MongoDBSearchSpec) DeepCopyInto(out *MongoDBSearchSpec) {
 		*out = new(v1.ResourceRequirements)
 		(*in).DeepCopyInto(*out)
 	}
+	out.Security = in.Security
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MongoDBSearchSpec.
@@ -150,6 +151,16 @@ func (in *MongoDBSource) DeepCopyInto(out *MongoDBSource) {
 		*out = new(user.MongoDBResourceRef)
 		**out = **in
 	}
+	if in.PasswordSecretRef != nil {
+		in, out := &in.PasswordSecretRef, &out.PasswordSecretRef
+		*out = new(user.SecretKeyRef)
+		**out = **in
+	}
+	if in.Username != nil {
+		in, out := &in.Username, &out.Username
+		*out = new(string)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new MongoDBSource.
@@ -161,3 +172,35 @@ func (in *MongoDBSource) DeepCopy() *MongoDBSource {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Security) DeepCopyInto(out *Security) {
+	*out = *in
+	out.TLS = in.TLS
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Security.
+func (in *Security) DeepCopy() *Security {
+	if in == nil {
+		return nil
+	}
+	out := new(Security)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLS) DeepCopyInto(out *TLS) {
+	*out = *in
+	out.CertificateKeySecret = in.CertificateKeySecret
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS.
+func (in *TLS) DeepCopy() *TLS {
+	if in == nil {
+		return nil
+	}
+	out := new(TLS)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/config/crd/bases/mongodb.com_mongodbsearch.yaml b/config/crd/bases/mongodb.com_mongodbsearch.yaml
index 272e7bc59..585b69210 100644
--- a/config/crd/bases/mongodb.com_mongodbsearch.yaml
+++ b/config/crd/bases/mongodb.com_mongodbsearch.yaml
@@ -149,6 +149,37 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
+              security:
+                properties:
+                  tls:
+                    properties:
+                      certificateKeySecretRef:
+                        description: |-
+                          CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
+                          The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
+                          This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
+                          Alternatively, an entry tls.pem, containing the concatenation of cert and key, can be provided.
+                          If all of tls.pem, tls.crt and tls.key are present, the tls.pem one needs to be equal to the concatenation of tls.crt and tls.key
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              TODO: Add other useful fields. apiVersion, kind, uid?
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      enabled:
+                        type: boolean
+                    required:
+                    - enabled
+                    type: object
+                type: object
               source:
                 properties:
                   mongodbResourceRef:
@@ -160,6 +191,21 @@ spec:
                     required:
                     - name
                     type: object
+                  passwordSecretRef:
+                    description: |-
+                      SecretKeyRef is a reference to a value in a given secret in the same
+                      namespace. Based on:
+                      https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#secretkeyselector-v1-core
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  username:
+                    type: string
                 type: object
               statefulSet:
                 description: |-
diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
index c2164c4f1..2be3a74c6 100644
--- a/config/manager/manager.yaml
+++ b/config/manager/manager.yaml
@@ -392,10 +392,10 @@ spec:
             - name: RELATED_IMAGE_MONGODB_IMAGE_8_0_0_ubi9
               value: "quay.io/mongodb/mongodb-enterprise-server:8.0.0-ubi9"
             - name: RELATED_IMAGE_MDB_SEARCH_IMAGE_1_47_0
-              value: "quay.io/mongodb/mongodb-search-community:1.47.0"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot/community:1.47.0"
             - name: MDB_SEARCH_COMMUNITY_REPO_URL
-              value: "quay.io/mongodb"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com"
             - name: MDB_SEARCH_COMMUNITY_NAME
-              value: "mongodb-search-community"
+              value: "mongot/community"
             - name: MDB_SEARCH_COMMUNITY_VERSION
               value: "1.47.0"
diff --git a/controllers/operator/mongodbsearch_controller.go b/controllers/operator/mongodbsearch_controller.go
index 63ed00a5f..bf8a5f022 100644
--- a/controllers/operator/mongodbsearch_controller.go
+++ b/controllers/operator/mongodbsearch_controller.go
@@ -13,6 +13,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 
 	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	searchv1 "github.com/mongodb/mongodb-kubernetes/api/v1/search"
@@ -67,7 +68,7 @@ func getSourceMongoDBForSearch(ctx context.Context, kubeClient client.Client, se
 	mdbcName := types.NamespacedName{Namespace: search.GetNamespace(), Name: sourceMongoDBResourceRef.Name}
 	mdbc := &mdbcv1.MongoDBCommunity{}
 	if err := kubeClient.Get(ctx, mdbcName, mdbc); err != nil {
-		return nil, xerrors.Errorf("error getting MongoDBCommunity %s", mdbcName)
+		return nil, xerrors.Errorf("error getting MongoDBCommunity %s: %w", mdbcName, err)
 	}
 	return search_controller.NewSearchSourceDBResourceFromMongoDBCommunity(mdbc), nil
 }
@@ -89,5 +90,6 @@ func AddMongoDBSearchController(ctx context.Context, mgr manager.Manager, operat
 		For(&searchv1.MongoDBSearch{}).
 		Watches(&mdbcv1.MongoDBCommunity{}, r.mdbcWatcher).
 		Owns(&appsv1.StatefulSet{}).
+		Owns(&corev1.Secret{}).
 		Complete(r)
 }
diff --git a/controllers/operator/mongodbsearch_controller_test.go b/controllers/operator/mongodbsearch_controller_test.go
index 3c4cfb556..ba3885042 100644
--- a/controllers/operator/mongodbsearch_controller_test.go
+++ b/controllers/operator/mongodbsearch_controller_test.go
@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/util/workqueue"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
 	"sigs.k8s.io/controller-runtime/pkg/event"
@@ -26,6 +27,7 @@ import (
 	"github.com/mongodb/mongodb-kubernetes/controllers/operator/workflow"
 	"github.com/mongodb/mongodb-kubernetes/controllers/search_controller"
 	mdbcv1 "github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/api/v1"
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/api/v1/common"
 	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/mongot"
 )
 
@@ -35,7 +37,7 @@ func newMongoDBCommunity(name, namespace string) *mdbcv1.MongoDBCommunity {
 		Spec: mdbcv1.MongoDBCommunitySpec{
 			Type:    mdbcv1.ReplicaSet,
 			Members: 1,
-			Version: "8.0",
+			Version: "8.0.10",
 		},
 	}
 }
@@ -51,8 +53,9 @@ func newMongoDBSearch(name, namespace, mdbcName string) *searchv1.MongoDBSearch
 	}
 }
 
-func newSearchReconciler(
+func newSearchReconcilerWithOperatorConfig(
 	mdbc *mdbcv1.MongoDBCommunity,
+	operatorConfig search_controller.OperatorSearchConfig,
 	searches ...*searchv1.MongoDBSearch,
 ) (*MongoDBSearchReconciler, client.Client) {
 	builder := mock.NewEmptyFakeClientBuilder()
@@ -69,25 +72,58 @@ func newSearchReconciler(
 	}
 
 	fakeClient := builder.Build()
-	return newMongoDBSearchReconciler(fakeClient, search_controller.OperatorSearchConfig{}), fakeClient
+
+	return newMongoDBSearchReconciler(fakeClient, operatorConfig), fakeClient
+}
+
+func newSearchReconciler(
+	mdbc *mdbcv1.MongoDBCommunity,
+	searches ...*searchv1.MongoDBSearch,
+) (*MongoDBSearchReconciler, client.Client) {
+	return newSearchReconcilerWithOperatorConfig(mdbc, search_controller.OperatorSearchConfig{}, searches...)
 }
 
 func buildExpectedMongotConfig(search *searchv1.MongoDBSearch, mdbc *mdbcv1.MongoDBCommunity) mongot.Config {
-	return mongot.Config{CommunityPrivatePreview: mongot.CommunityPrivatePreview{
-		MongodHostAndPort: fmt.Sprintf(
-			"%s.%s.svc.cluster.local:%d",
-			mdbc.ServiceName(), mdbc.Namespace,
-			mdbc.GetMongodConfiguration().GetDBPort(),
-		),
-		QueryServerAddress: fmt.Sprintf("localhost:%d", search.GetMongotPort()),
-		KeyFilePath:        "/mongot/keyfile/keyfile",
-		DataPath:           "/mongot/data/config.yml",
-		Metrics: mongot.Metrics{
+	var hostAndPorts []string
+	for i := range mdbc.Spec.Members {
+		hostAndPorts = append(hostAndPorts, fmt.Sprintf("%s-%d.%s.%s.svc.cluster.local:%d", mdbc.Name, i, mdbc.Name+"-svc", search.Namespace, 27017))
+	}
+	return mongot.Config{
+		SyncSource: mongot.ConfigSyncSource{
+			ReplicaSet: mongot.ConfigReplicaSet{
+				HostAndPort:    hostAndPorts,
+				Username:       searchv1.MongotDefaultSyncSourceUsername,
+				PasswordFile:   "/tmp/sourceUserPassword",
+				TLS:            ptr.To(false),
+				ReadPreference: ptr.To("secondaryPreferred"),
+				AuthSource:     ptr.To("admin"),
+			},
+		},
+		Storage: mongot.ConfigStorage{
+			DataPath: "/mongot/data/config.yml",
+		},
+		Server: mongot.ConfigServer{
+			Wireproto: &mongot.ConfigWireproto{
+				Address: "0.0.0.0:27027",
+				Authentication: &mongot.ConfigAuthentication{
+					Mode:    "keyfile",
+					KeyFile: "/tmp/keyfile",
+				},
+				TLS: mongot.ConfigTLS{Mode: mongot.ConfigTLSModeDisabled},
+			},
+		},
+		Metrics: mongot.ConfigMetrics{
 			Enabled: true,
-			Address: fmt.Sprintf("localhost:%d", search.GetMongotMetricsPort()),
+			Address: fmt.Sprintf("0.0.0.0:%d", search.GetMongotMetricsPort()),
+		},
+		HealthCheck: mongot.ConfigHealthCheck{
+			Address: fmt.Sprintf("0.0.0.0:%d", search.GetMongotHealthCheckPort()),
 		},
-		Logging: mongot.Logging{Verbosity: "DEBUG"},
-	}}
+		Logging: mongot.ConfigLogging{
+			Verbosity: "TRACE",
+			LogPath:   nil,
+		},
+	}
 }
 
 func TestMongoDBSearchReconcile_NotFound(t *testing.T) {
@@ -184,16 +220,6 @@ func TestMongoDBSearchReconcile_InvalidVersion(t *testing.T) {
 	checkSearchReconcileFailed(ctx, t, reconciler, c, search, "MongoDB version")
 }
 
-func TestMongoDBSearchReconcile_TLSNotSupported(t *testing.T) {
-	ctx := context.Background()
-	search := newMongoDBSearch("search", mock.TestNamespace, "mdb")
-	mdbc := newMongoDBCommunity("mdb", mock.TestNamespace)
-	mdbc.Spec.Security.TLS.Enabled = true
-	reconciler, c := newSearchReconciler(mdbc, search)
-
-	checkSearchReconcileFailed(ctx, t, reconciler, c, search, "TLS-enabled")
-}
-
 func TestMongoDBSearchReconcile_MultipleSearchResources(t *testing.T) {
 	ctx := context.Background()
 	search1 := newMongoDBSearch("search1", mock.TestNamespace, "mdb")
@@ -203,3 +229,60 @@ func TestMongoDBSearchReconcile_MultipleSearchResources(t *testing.T) {
 
 	checkSearchReconcileFailed(ctx, t, reconciler, c, search1, "multiple MongoDBSearch")
 }
+
+func TestMongoDBSearchReconcile_InvalidSearchImageVersion(t *testing.T) {
+	ctx := context.Background()
+	expectedMsg := "MongoDBSearch version 1.47.0 is not supported because of breaking changes. The operator will ignore this resource: it will not reconcile or reconfigure the workload. Existing deployments will continue to run, but cannot be managed by the operator. To regain operator management, you must delete and recreate the MongoDBSearch resource."
+
+	tests := []struct {
+		name              string
+		specVersion       string
+		operatorVersion   string
+		statefulSetConfig *common.StatefulSetConfiguration
+	}{
+		{
+			name:        "unsupported version in Spec.Version",
+			specVersion: "1.47.0",
+		},
+		{
+			name:            "unsupported version in operator config",
+			operatorVersion: "1.47.0",
+		},
+		{
+			name: "unsupported version in StatefulSetConfiguration",
+			statefulSetConfig: &common.StatefulSetConfiguration{
+				SpecWrapper: common.StatefulSetSpecWrapper{
+					Spec: appsv1.StatefulSetSpec{
+						Template: corev1.PodTemplateSpec{
+							Spec: corev1.PodSpec{
+								Containers: []corev1.Container{
+									{
+										Name:  search_controller.MongotContainerName,
+										Image: "testrepo/mongot:1.47.0",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			search := newMongoDBSearch("search", mock.TestNamespace, "mdb")
+			mdbc := newMongoDBCommunity("mdb", mock.TestNamespace)
+
+			search.Spec.Version = tc.specVersion
+			search.Spec.StatefulSetConfiguration = tc.statefulSetConfig
+
+			operatorConfig := search_controller.OperatorSearchConfig{
+				SearchVersion: tc.operatorVersion,
+			}
+			reconciler, _ := newSearchReconcilerWithOperatorConfig(mdbc, operatorConfig, search)
+
+			checkSearchReconcileFailed(ctx, t, reconciler, reconciler.kubeClient, search, expectedMsg)
+		})
+	}
+}
diff --git a/controllers/search_controller/mongodbsearch_reconcile_helper.go b/controllers/search_controller/mongodbsearch_reconcile_helper.go
index 59523ce8e..08a264853 100644
--- a/controllers/search_controller/mongodbsearch_reconcile_helper.go
+++ b/controllers/search_controller/mongodbsearch_reconcile_helper.go
@@ -13,6 +13,7 @@ import (
 	"golang.org/x/xerrors"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
@@ -22,15 +23,24 @@ import (
 
 	searchv1 "github.com/mongodb/mongodb-kubernetes/api/v1/search"
 	"github.com/mongodb/mongodb-kubernetes/controllers/operator/workflow"
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/automationconfig"
 	kubernetesClient "github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/kube/client"
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/kube/container"
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/kube/podtemplatespec"
 	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/kube/service"
 	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/mongot"
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/tls"
 	"github.com/mongodb/mongodb-kubernetes/pkg/kube/commoncontroller"
 	"github.com/mongodb/mongodb-kubernetes/pkg/statefulset"
 )
 
 const (
-	MongoDBSearchIndexFieldName = "mdbsearch-for-mongodbresourceref-index"
+	MongoDBSearchIndexFieldName      = "mdbsearch-for-mongodbresourceref-index"
+	unsupportedSearchVersion         = "1.47.0"
+	unsupportedSearchVersionErrorFmt = "MongoDBSearch version %s is not supported because of breaking changes. " +
+		"The operator will ignore this resource: it will not reconcile or reconfigure the workload. " +
+		"Existing deployments will continue to run, but cannot be managed by the operator. " +
+		"To regain operator management, you must delete and recreate the MongoDBSearch resource."
 )
 
 type OperatorSearchConfig struct {
@@ -76,6 +86,10 @@ func (r *MongoDBSearchReconcileHelper) reconcile(ctx context.Context, log *zap.S
 		return workflow.Failed(err)
 	}
 
+	if err := r.ValidateSearchImageVersion(); err != nil {
+		return workflow.Failed(err)
+	}
+
 	if err := r.ValidateSingleMongoDBSearchForSearchSource(ctx); err != nil {
 		return workflow.Failed(err)
 	}
@@ -84,13 +98,28 @@ func (r *MongoDBSearchReconcileHelper) reconcile(ctx context.Context, log *zap.S
 		return workflow.Failed(err)
 	}
 
-	mongotConfig := createMongotConfig(r.mdbSearch, r.db)
-	configHash, err := r.ensureMongotConfig(ctx, mongotConfig)
+	ingressTlsMongotModification, ingressTlsStsModification, err := r.ensureIngressTlsConfig(ctx)
+	if err != nil {
+		return workflow.Failed(err)
+	}
+
+	egressTlsMongotModification, egressTlsStsModification, err := r.ensureEgressTlsConfig(ctx)
+	if err != nil {
+		return workflow.Failed(err)
+	}
+
+	configHash, err := r.ensureMongotConfig(ctx, log, createMongotConfig(r.mdbSearch, r.db), ingressTlsMongotModification, egressTlsMongotModification)
 	if err != nil {
 		return workflow.Failed(err)
 	}
 
-	if err := r.createOrUpdateStatefulSet(ctx, log, configHash); err != nil {
+	configHashModification := statefulset.WithPodSpecTemplate(podtemplatespec.WithAnnotations(
+		map[string]string{
+			"mongotConfigHash": configHash,
+		},
+	))
+
+	if err := r.createOrUpdateStatefulSet(ctx, log, CreateSearchStatefulSetFunc(r.mdbSearch, r.db, r.buildImageString()), configHashModification, ingressTlsStsModification, egressTlsStsModification); err != nil {
 		return workflow.Failed(err)
 	}
 
@@ -101,18 +130,19 @@ func (r *MongoDBSearchReconcileHelper) reconcile(ctx context.Context, log *zap.S
 	return workflow.OK()
 }
 
-func (r *MongoDBSearchReconcileHelper) createOrUpdateStatefulSet(ctx context.Context, log *zap.SugaredLogger, mongotConfigHash string) error {
+func (r *MongoDBSearchReconcileHelper) buildImageString() string {
 	imageVersion := r.mdbSearch.Spec.Version
 	if imageVersion == "" {
 		imageVersion = r.operatorSearchConfig.SearchVersion
 	}
-	searchImage := fmt.Sprintf("%s/%s:%s", r.operatorSearchConfig.SearchRepo, r.operatorSearchConfig.SearchName, imageVersion)
+	return fmt.Sprintf("%s/%s:%s", r.operatorSearchConfig.SearchRepo, r.operatorSearchConfig.SearchName, imageVersion)
+}
 
+func (r *MongoDBSearchReconcileHelper) createOrUpdateStatefulSet(ctx context.Context, log *zap.SugaredLogger, modifications ...statefulset.Modification) error {
 	stsName := r.mdbSearch.StatefulSetNamespacedName()
 	sts := &appsv1.StatefulSet{ObjectMeta: metav1.ObjectMeta{Name: stsName.Name, Namespace: stsName.Namespace}}
 	op, err := controllerutil.CreateOrUpdate(ctx, r.client, sts, func() error {
-		stsModification := CreateSearchStatefulSetFunc(r.mdbSearch, r.db, searchImage, mongotConfigHash)
-		stsModification(sts)
+		statefulset.Apply(modifications...)(sts)
 		return nil
 	})
 	if err != nil {
@@ -142,7 +172,9 @@ func (r *MongoDBSearchReconcileHelper) ensureSearchService(ctx context.Context,
 	return nil
 }
 
-func (r *MongoDBSearchReconcileHelper) ensureMongotConfig(ctx context.Context, mongotConfig mongot.Config) (string, error) {
+func (r *MongoDBSearchReconcileHelper) ensureMongotConfig(ctx context.Context, log *zap.SugaredLogger, modifications ...mongot.Modification) (string, error) {
+	mongotConfig := mongot.Config{}
+	mongot.Apply(modifications...)(&mongotConfig)
 	configData, err := yaml.Marshal(mongotConfig)
 	if err != nil {
 		return "", err
@@ -163,11 +195,98 @@ func (r *MongoDBSearchReconcileHelper) ensureMongotConfig(ctx context.Context, m
 		return "", err
 	}
 
-	zap.S().Debugf("Updated mongot config yaml config map: %v (%s) with the following configuration: %s", cmName, op, string(configData))
+	log.Debugf("Updated mongot config yaml config map: %v (%s) with the following configuration: %s", cmName, op, string(configData))
 
 	return hashMongotConfig(configData), nil
 }
 
+func (r *MongoDBSearchReconcileHelper) ensureIngressTlsConfig(ctx context.Context) (mongot.Modification, statefulset.Modification, error) {
+	if !r.mdbSearch.Spec.Security.TLS.Enabled {
+		mongotModification := func(config *mongot.Config) {
+			config.Server.Wireproto.TLS.Mode = mongot.ConfigTLSModeDisabled
+		}
+		return mongotModification, statefulset.NOOP(), nil
+	}
+
+	// TODO: validate that the certificate in the user-provided Secret in .spec.security.tls.certificateKeySecret is issued by the CA in the operator's CA Secret
+
+	certFileName, err := tls.EnsureTLSSecret(ctx, r.client, r.mdbSearch)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	mongotModification := func(config *mongot.Config) {
+		certPath := tls.OperatorSecretMountPath + certFileName
+		config.Server.Wireproto.TLS.Mode = mongot.ConfigTLSModeTLS
+		config.Server.Wireproto.TLS.CertificateKeyFile = ptr.To(certPath)
+	}
+
+	tlsSecret := r.mdbSearch.TLSOperatorSecretNamespacedName()
+	tlsVolume := statefulset.CreateVolumeFromSecret("tls", tlsSecret.Name)
+	tlsVolumeMount := statefulset.CreateVolumeMount("tls", tls.OperatorSecretMountPath, statefulset.WithReadOnly(true))
+	statefulsetModification := statefulset.WithPodSpecTemplate(podtemplatespec.Apply(
+		podtemplatespec.WithVolume(tlsVolume),
+		podtemplatespec.WithContainer(MongotContainerName, container.Apply(
+			container.WithVolumeMounts([]corev1.VolumeMount{tlsVolumeMount}),
+		)),
+	))
+
+	return mongotModification, statefulsetModification, nil
+}
+
+func (r *MongoDBSearchReconcileHelper) ensureEgressTlsConfig(ctx context.Context) (mongot.Modification, statefulset.Modification, error) {
+	if !r.db.IsSecurityTLSConfigEnabled() {
+		return mongot.NOOP(), statefulset.NOOP(), nil
+	}
+
+	caSecretName := r.db.TLSOperatorCASecretNamespacedName()
+	caSecret := &corev1.Secret{}
+	if err := r.client.Get(ctx, caSecretName, caSecret); err != nil {
+		return nil, nil, xerrors.Errorf("error getting CA Secret %s: %w", caSecretName, err)
+	}
+
+	// HACK: find a better way of getting the CA file name
+	var caFileName string
+	for k := range caSecret.Data {
+		caFileName = k
+	}
+
+	mongotModification := func(config *mongot.Config) {
+		config.SyncSource.ReplicaSet.TLS = ptr.To(true)
+	}
+
+	_, containerSecurityContext := podtemplatespec.WithDefaultSecurityContextsModifications()
+	caVolume := statefulset.CreateVolumeFromSecret("ca", caSecretName.Name)
+	trustStoreVolume := statefulset.CreateVolumeFromEmptyDir("cacerts")
+	statefulsetModification := statefulset.WithPodSpecTemplate(podtemplatespec.Apply(
+		podtemplatespec.WithVolume(caVolume),
+		podtemplatespec.WithVolume(trustStoreVolume),
+		podtemplatespec.WithInitContainer("init-cacerts", container.Apply(
+			container.WithImage(r.buildImageString()),
+			containerSecurityContext,
+			container.WithVolumeMounts([]corev1.VolumeMount{
+				statefulset.CreateVolumeMount(caVolume.Name, tls.CAMountPath, statefulset.WithReadOnly(true)),
+				statefulset.CreateVolumeMount(trustStoreVolume.Name, "/java/trust-store", statefulset.WithReadOnly(false)),
+			}),
+			container.WithCommand([]string{"sh"}),
+			container.WithArgs([]string{
+				"-c",
+				fmt.Sprintf(`
+cp /mongot-community/bin/jdk/lib/security/cacerts /java/trust-store/cacerts
+/mongot-community/bin/jdk/bin/keytool -keystore /java/trust-store/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias mongodcert -file %s/%s
+							`, tls.CAMountPath, caFileName),
+			}),
+		)),
+		podtemplatespec.WithContainer(MongotContainerName, container.Apply(
+			container.WithVolumeMounts([]corev1.VolumeMount{
+				statefulset.CreateVolumeMount(trustStoreVolume.Name, "/mongot-community/bin/jdk/lib/security/cacerts", statefulset.WithReadOnly(true), statefulset.WithSubPath("cacerts")),
+			}),
+		)),
+	))
+
+	return mongotModification, statefulsetModification, nil
+}
+
 func hashMongotConfig(mongotConfigYaml []byte) string {
 	hashBytes := sha256.Sum256(mongotConfigYaml)
 	return base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(hashBytes[:])
@@ -203,30 +322,70 @@ func buildSearchHeadlessService(search *searchv1.MongoDBSearch) corev1.Service {
 		TargetPort: intstr.FromInt32(search.GetMongotMetricsPort()),
 	})
 
+	serviceBuilder.AddPort(&corev1.ServicePort{
+		Name:       "healthcheck",
+		Protocol:   corev1.ProtocolTCP,
+		Port:       search.GetMongotHealthCheckPort(),
+		TargetPort: intstr.FromInt32(search.GetMongotHealthCheckPort()),
+	})
+
 	return serviceBuilder.Build()
 }
 
-func createMongotConfig(search *searchv1.MongoDBSearch, db SearchSourceDBResource) mongot.Config {
-	return mongot.Config{CommunityPrivatePreview: mongot.CommunityPrivatePreview{
-		MongodHostAndPort:  fmt.Sprintf("%s.%s.svc.cluster.local:%d", db.DatabaseServiceName(), db.GetNamespace(), db.DatabasePort()),
-		QueryServerAddress: fmt.Sprintf("localhost:%d", search.GetMongotPort()),
-		KeyFilePath:        "/mongot/keyfile/keyfile",
-		DataPath:           "/mongot/data/config.yml",
-		Metrics: mongot.Metrics{
+func createMongotConfig(search *searchv1.MongoDBSearch, db SearchSourceDBResource) mongot.Modification {
+	return func(config *mongot.Config) {
+		var hostAndPorts []string
+		for i := range db.Members() {
+			hostAndPorts = append(hostAndPorts, fmt.Sprintf("%s-%d.%s.%s.svc.cluster.local:%d", db.Name(), i, db.DatabaseServiceName(), db.GetNamespace(), db.DatabasePort()))
+		}
+
+		config.SyncSource = mongot.ConfigSyncSource{
+			ReplicaSet: mongot.ConfigReplicaSet{
+				HostAndPort:    hostAndPorts,
+				Username:       search.SourceUsername(),
+				PasswordFile:   "/tmp/sourceUserPassword",
+				TLS:            ptr.To(false),
+				ReadPreference: ptr.To("secondaryPreferred"),
+				AuthSource:     ptr.To("admin"),
+			},
+		}
+		config.Storage = mongot.ConfigStorage{
+			DataPath: "/mongot/data/config.yml",
+		}
+		config.Server = mongot.ConfigServer{
+			Wireproto: &mongot.ConfigWireproto{
+				Address: "0.0.0.0:27027",
+				Authentication: &mongot.ConfigAuthentication{
+					Mode:    "keyfile",
+					KeyFile: "/tmp/keyfile",
+				},
+			},
+		}
+		config.Metrics = mongot.ConfigMetrics{
 			Enabled: true,
-			Address: fmt.Sprintf("localhost:%d", search.GetMongotMetricsPort()),
-		},
-		Logging: mongot.Logging{
-			Verbosity: "DEBUG",
-		},
-	}}
+			Address: fmt.Sprintf("0.0.0.0:%d", search.GetMongotMetricsPort()),
+		}
+		config.HealthCheck = mongot.ConfigHealthCheck{
+			Address: fmt.Sprintf("0.0.0.0:%d", search.GetMongotHealthCheckPort()),
+		}
+		config.Logging = mongot.ConfigLogging{
+			Verbosity: "TRACE",
+			LogPath:   nil,
+		}
+	}
 }
 
-func GetMongodConfigParameters(search *searchv1.MongoDBSearch) map[string]interface{} {
-	return map[string]interface{}{
-		"setParameter": map[string]interface{}{
-			"mongotHost":                       mongotHostAndPort(search),
-			"searchIndexManagementHostAndPort": mongotHostAndPort(search),
+func GetMongodConfigParameters(search *searchv1.MongoDBSearch) map[string]any {
+	searchTLSMode := automationconfig.TLSModeDisabled
+	if search.Spec.Security.TLS.Enabled {
+		searchTLSMode = automationconfig.TLSModeRequired
+	}
+	return map[string]any{
+		"setParameter": map[string]any{
+			"mongotHost":                                      mongotHostAndPort(search),
+			"searchIndexManagementHostAndPort":                mongotHostAndPort(search),
+			"skipAuthenticationToSearchIndexManagementServer": false,
+			"searchTLSMode":                                   searchTLSMode,
 		},
 	}
 }
@@ -240,12 +399,8 @@ func ValidateSearchSource(db SearchSourceDBResource) error {
 	version, err := semver.ParseTolerant(db.GetMongoDBVersion())
 	if err != nil {
 		return xerrors.Errorf("error parsing MongoDB version '%s': %w", db.GetMongoDBVersion(), err)
-	} else if version.Major < 8 {
-		return xerrors.New("MongoDB version must be 8.0 or higher")
-	}
-
-	if db.IsSecurityTLSConfigEnabled() {
-		return xerrors.New("MongoDBSearch does not support TLS-enabled sources")
+	} else if version.LT(semver.MustParse("8.0.10")) {
+		return xerrors.New("MongoDB version must be 8.0.10 or higher")
 	}
 
 	return nil
@@ -264,8 +419,44 @@ func (r *MongoDBSearchReconcileHelper) ValidateSingleMongoDBSearchForSearchSourc
 		for i, search := range searchList.Items {
 			resourceNames[i] = search.Name
 		}
-		return xerrors.Errorf("Found multiple MongoDBSearch resources for search source '%s': %s", r.db.Name(), strings.Join(resourceNames, ", "))
+		return xerrors.Errorf(
+			"Found multiple MongoDBSearch resources for search source '%s': %s", r.db.Name(),
+			strings.Join(resourceNames, ", "),
+		)
 	}
 
 	return nil
 }
+
+func (r *MongoDBSearchReconcileHelper) ValidateSearchImageVersion() error {
+	version := r.getMongotImage()
+
+	if strings.Contains(version, unsupportedSearchVersion) {
+		return xerrors.Errorf(unsupportedSearchVersionErrorFmt, unsupportedSearchVersion)
+	}
+
+	return nil
+}
+
+func (r *MongoDBSearchReconcileHelper) getMongotImage() string {
+	version := strings.TrimSpace(r.mdbSearch.Spec.Version)
+	if version != "" {
+		return version
+	}
+
+	if r.operatorSearchConfig.SearchVersion != "" {
+		return r.operatorSearchConfig.SearchVersion
+	}
+
+	if r.mdbSearch.Spec.StatefulSetConfiguration == nil {
+		return ""
+	}
+
+	for _, container := range r.mdbSearch.Spec.StatefulSetConfiguration.SpecWrapper.Spec.Template.Spec.Containers {
+		if container.Name == MongotContainerName {
+			return container.Image
+		}
+	}
+
+	return ""
+}
diff --git a/controllers/search_controller/mongodbsearch_reconcile_helper_test.go b/controllers/search_controller/mongodbsearch_reconcile_helper_test.go
index fe03ceb70..f70ec9a03 100644
--- a/controllers/search_controller/mongodbsearch_reconcile_helper_test.go
+++ b/controllers/search_controller/mongodbsearch_reconcile_helper_test.go
@@ -34,14 +34,14 @@ func TestMongoDBSearchReconcileHelper_ValidateSearchSource(t *testing.T) {
 					Version: "4.4.0",
 				},
 			},
-			expectedError: "MongoDB version must be 8.0 or higher",
+			expectedError: "MongoDB version must be 8.0.10 or higher",
 		},
 		{
 			name: "Valid version",
 			mdbc: mdbcv1.MongoDBCommunity{
 				ObjectMeta: mdbcMeta,
 				Spec: mdbcv1.MongoDBCommunitySpec{
-					Version: "8.0",
+					Version: "8.0.10",
 				},
 			},
 		},
@@ -50,7 +50,7 @@ func TestMongoDBSearchReconcileHelper_ValidateSearchSource(t *testing.T) {
 			mdbc: mdbcv1.MongoDBCommunity{
 				ObjectMeta: mdbcMeta,
 				Spec: mdbcv1.MongoDBCommunitySpec{
-					Version: "8.0",
+					Version: "8.0.10",
 					Security: mdbcv1.Security{
 						TLS: mdbcv1.TLS{
 							Enabled: true,
@@ -58,7 +58,6 @@ func TestMongoDBSearchReconcileHelper_ValidateSearchSource(t *testing.T) {
 					},
 				},
 			},
-			expectedError: "MongoDBSearch does not support TLS-enabled sources",
 		},
 	}
 
diff --git a/controllers/search_controller/search_construction.go b/controllers/search_controller/search_construction.go
index ea169339d..6aae8e982 100644
--- a/controllers/search_controller/search_construction.go
+++ b/controllers/search_controller/search_construction.go
@@ -19,7 +19,9 @@ import (
 )
 
 const (
-	MongotContainerName = "mongot"
+	MongotContainerName      = "mongot"
+	SearchLivenessProbePath  = "/health"
+	SearchReadinessProbePath = "/health" // Todo: Update this when search GA is available
 )
 
 // SearchSourceDBResource is an object wrapping a MongoDBCommunity object
@@ -38,6 +40,8 @@ type SearchSourceDBResource interface {
 	DatabasePort() int
 	GetMongoDBVersion() string
 	IsSecurityTLSConfigEnabled() bool
+	TLSOperatorCASecretNamespacedName() types.NamespacedName
+	Members() int
 }
 
 func NewSearchSourceDBResourceFromMongoDBCommunity(mdbc *mdbcv1.MongoDBCommunity) SearchSourceDBResource {
@@ -48,6 +52,10 @@ type mdbcSearchResource struct {
 	db *mdbcv1.MongoDBCommunity
 }
 
+func (r *mdbcSearchResource) Members() int {
+	return r.db.Spec.Members
+}
+
 func (r *mdbcSearchResource) Name() string {
 	return r.db.Name
 }
@@ -84,8 +92,12 @@ func (r *mdbcSearchResource) DatabasePort() int {
 	return r.db.GetMongodConfiguration().GetDBPort()
 }
 
+func (r *mdbcSearchResource) TLSOperatorCASecretNamespacedName() types.NamespacedName {
+	return r.db.TLSOperatorCASecretNamespacedName()
+}
+
 // ReplicaSetOptions returns a set of options which will configure a ReplicaSet StatefulSet
-func CreateSearchStatefulSetFunc(mdbSearch *searchv1.MongoDBSearch, sourceDBResource SearchSourceDBResource, searchImage string, mongotConfigHash string) statefulset.Modification {
+func CreateSearchStatefulSetFunc(mdbSearch *searchv1.MongoDBSearch, sourceDBResource SearchSourceDBResource, searchImage string) statefulset.Modification {
 	labels := map[string]string{
 		"app": mdbSearch.SearchServiceNamespacedName().Name,
 	}
@@ -95,14 +107,18 @@ func CreateSearchStatefulSetFunc(mdbSearch *searchv1.MongoDBSearch, sourceDBReso
 
 	dataVolumeName := "data"
 	keyfileVolumeName := "keyfile"
+	sourceUserPasswordVolumeName := "password"
 	mongotConfigVolumeName := "config"
 
 	pvcVolumeMount := statefulset.CreateVolumeMount(dataVolumeName, "/mongot/data", statefulset.WithSubPath("data"))
 
-	keyfileVolume := statefulset.CreateVolumeFromSecret("keyfile", sourceDBResource.KeyfileSecretName())
+	keyfileVolume := statefulset.CreateVolumeFromSecret(keyfileVolumeName, sourceDBResource.KeyfileSecretName())
 	keyfileVolumeMount := statefulset.CreateVolumeMount(keyfileVolumeName, "/mongot/keyfile", statefulset.WithReadOnly(true))
 
-	mongotConfigVolume := statefulset.CreateVolumeFromConfigMap("config", mdbSearch.MongotConfigConfigMapNamespacedName().Name)
+	sourceUserPasswordVolume := statefulset.CreateVolumeFromSecret(sourceUserPasswordVolumeName, mdbSearch.SourceUserPasswordSecretRef().Name)
+	sourceUserPasswordVolumeMount := statefulset.CreateVolumeMount(sourceUserPasswordVolumeName, "/mongot/sourceUserPassword", statefulset.WithReadOnly(true))
+
+	mongotConfigVolume := statefulset.CreateVolumeFromConfigMap(mongotConfigVolumeName, mdbSearch.MongotConfigConfigMapNamespacedName().Name)
 	mongotConfigVolumeMount := statefulset.CreateVolumeMount(mongotConfigVolumeName, "/mongot/config", statefulset.WithReadOnly(true))
 
 	var persistenceConfig *common.PersistenceConfig
@@ -120,12 +136,14 @@ func CreateSearchStatefulSetFunc(mdbSearch *searchv1.MongoDBSearch, sourceDBReso
 		keyfileVolumeMount,
 		tmpVolumeMount,
 		mongotConfigVolumeMount,
+		sourceUserPasswordVolumeMount,
 	}
 
 	volumes := []corev1.Volume{
 		tmpVolume,
 		keyfileVolume,
 		mongotConfigVolume,
+		sourceUserPasswordVolume,
 	}
 
 	stsModifications := []statefulset.Modification{
@@ -142,9 +160,6 @@ func CreateSearchStatefulSetFunc(mdbSearch *searchv1.MongoDBSearch, sourceDBReso
 			podtemplatespec.Apply(
 				podSecurityContext,
 				podtemplatespec.WithPodLabels(labels),
-				podtemplatespec.WithAnnotations(map[string]string{
-					"mongotConfigHash": mongotConfigHash,
-				}),
 				podtemplatespec.WithVolumes(volumes),
 				podtemplatespec.WithServiceAccount(sourceDBResource.DatabaseServiceName()),
 				podtemplatespec.WithServiceAccount(util.MongoDBServiceAccount),
@@ -170,22 +185,65 @@ func mongodbSearchContainer(mdbSearch *searchv1.MongoDBSearch, volumeMounts []co
 		container.WithName(MongotContainerName),
 		container.WithImage(searchImage),
 		container.WithImagePullPolicy(corev1.PullAlways),
-		container.WithReadinessProbe(probes.Apply(
-			probes.WithTCPSocket("", intstr.FromInt32(mdbSearch.GetMongotPort())),
-			probes.WithInitialDelaySeconds(20),
-			probes.WithPeriodSeconds(10),
-		)),
+		container.WithLivenessProbe(mongotLivenessProbe(mdbSearch)),
+		container.WithReadinessProbe(mongotReadinessProbe(mdbSearch)),
 		container.WithResourceRequirements(createSearchResourceRequirements(mdbSearch.Spec.ResourceRequirements)),
 		container.WithVolumeMounts(volumeMounts),
 		container.WithCommand([]string{"sh"}),
 		container.WithArgs([]string{
 			"-c",
-			"/mongot-community/mongot --config /mongot/config/config.yml",
+			`
+cp /mongot/keyfile/keyfile /tmp/keyfile
+chown 2000:2000 /tmp/keyfile
+chmod 0600 /tmp/keyfile
+
+cp /mongot/sourceUserPassword/password /tmp/sourceUserPassword
+chown 2000:2000 /tmp/sourceUserPassword
+chmod 0600 /tmp/sourceUserPassword
+
+/mongot-community/mongot --config /mongot/config/config.yml
+`,
 		}),
 		containerSecurityContext,
 	)
 }
 
+func mongotLivenessProbe(search *searchv1.MongoDBSearch) func(*corev1.Probe) {
+	return probes.Apply(
+		probes.WithHandler(corev1.ProbeHandler{
+			HTTPGet: &corev1.HTTPGetAction{
+				Scheme: corev1.URISchemeHTTP,
+				Port:   intstr.FromInt32(search.GetMongotHealthCheckPort()),
+				Path:   SearchLivenessProbePath,
+			},
+		}),
+		probes.WithInitialDelaySeconds(10),
+		probes.WithPeriodSeconds(10),
+		probes.WithTimeoutSeconds(5),
+		probes.WithSuccessThreshold(1),
+		probes.WithFailureThreshold(10),
+	)
+}
+
+// mongotReadinessProbe just uses the endpoint intended for liveness checks;
+// readiness check endpoint may be available in search GA.
+func mongotReadinessProbe(search *searchv1.MongoDBSearch) func(*corev1.Probe) {
+	return probes.Apply(
+		probes.WithHandler(corev1.ProbeHandler{
+			HTTPGet: &corev1.HTTPGetAction{
+				Scheme: corev1.URISchemeHTTP,
+				Port:   intstr.FromInt32(search.GetMongotHealthCheckPort()),
+				Path:   SearchReadinessProbePath,
+			},
+		}),
+		probes.WithInitialDelaySeconds(20),
+		probes.WithPeriodSeconds(10),
+		probes.WithTimeoutSeconds(5),
+		probes.WithSuccessThreshold(1),
+		probes.WithFailureThreshold(3),
+	)
+}
+
 func createSearchResourceRequirements(requirements *corev1.ResourceRequirements) corev1.ResourceRequirements {
 	if requirements != nil {
 		return *requirements
diff --git a/docker/mongodb-kubernetes-init-ops-manager/mmsconfiguration/edit_mms_configuration.go b/docker/mongodb-kubernetes-init-ops-manager/mmsconfiguration/edit_mms_configuration.go
index 793914d3a..ca7b9a3b0 100755
--- a/docker/mongodb-kubernetes-init-ops-manager/mmsconfiguration/edit_mms_configuration.go
+++ b/docker/mongodb-kubernetes-init-ops-manager/mmsconfiguration/edit_mms_configuration.go
@@ -145,7 +145,7 @@ func readLinesFromFile(name string) ([]string, error) {
 func writeLinesToFile(name string, lines []string) error {
 	output := strings.Join(lines, lineBreak)
 
-	err := os.WriteFile(name, []byte(output), 0o775)
+	err := os.WriteFile(name, []byte(output), 0o644)
 	if err != nil {
 		return xerrors.Errorf("error writing to file %s: %w", name, err)
 	}
@@ -168,7 +168,7 @@ func appendLinesToFile(name string, lines string) error {
 
 func getOmPropertiesFromEnvVars() map[string]string {
 	props := map[string]string{}
-	for _, pair := range os.Environ() {
+	for _, pair := range os.Environ() { // nolint:forbidigo
 		if !strings.HasPrefix(pair, omPropertyPrefix) {
 			continue
 		}
diff --git a/docker/mongodb-kubernetes-tests/kubetester/helm.py b/docker/mongodb-kubernetes-tests/kubetester/helm.py
index da6887b81..9e0cca8fe 100644
--- a/docker/mongodb-kubernetes-tests/kubetester/helm.py
+++ b/docker/mongodb-kubernetes-tests/kubetester/helm.py
@@ -120,6 +120,9 @@ def helm_repo_add(repo_name: str, url: str):
 
 
 def process_run_and_check(args, **kwargs):
+    if "check" not in kwargs:
+        kwargs["check"] = True
+
     try:
         logger.debug(f"subprocess.run: {args}")
         completed_process = subprocess.run(args, **kwargs)
diff --git a/docker/mongodb-kubernetes-tests/tests/common/search/movies_search_helper.py b/docker/mongodb-kubernetes-tests/tests/common/search/movies_search_helper.py
index e5629bda0..be2151158 100644
--- a/docker/mongodb-kubernetes-tests/tests/common/search/movies_search_helper.py
+++ b/docker/mongodb-kubernetes-tests/tests/common/search/movies_search_helper.py
@@ -1,3 +1,7 @@
+import logging
+
+import pymongo.errors
+from kubetester import kubetester
 from tests import test_logger
 from tests.common.search.search_tester import SearchTester
 
@@ -26,9 +30,33 @@ def create_search_index(self):
     def wait_for_search_indexes(self):
         self.search_tester.wait_for_search_indexes_ready(self.db_name, self.col_name)
 
-    def assert_search_query(self):
-        # sample taken from: https://www.mongodb.com/docs/atlas/atlas-search/tutorial/run-query/#run-a-complex-query-on-the-movies-collection-7
-        result = self.search_tester.client[self.db_name][self.col_name].aggregate(
+    def assert_search_query(self, retry_timeout: int = 1):
+        def wait_for_search_results():
+            # sample taken from: https://www.mongodb.com/docs/atlas/atlas-search/tutorial/run-query/#run-a-complex-query-on-the-movies-collection-7
+            count = 0
+            status_msg = ""
+            try:
+                result = self.execute_example_search_query()
+                status_msg = f"{self.db_name}/{self.col_name}: search query results:\n"
+                for r in result:
+                    status_msg += f"{r}\n"
+                    count += 1
+                status_msg += f"Count: {count}"
+                logger.debug(status_msg)
+            except pymongo.errors.PyMongoError as e:
+                logger.debug(f"error: {e}")
+
+            return count == 4, status_msg
+
+        kubetester.run_periodically(
+            fn=wait_for_search_results,
+            timeout=retry_timeout,
+            sleep_time=1,
+            msg="Search query to return correct data",
+        )
+
+    def execute_example_search_query(self):
+        return self.search_tester.client[self.db_name][self.col_name].aggregate(
             [
                 {
                     "$search": {
@@ -47,11 +75,3 @@ def assert_search_query(self):
                 {"$project": {"title": 1, "plot": 1, "genres": 1, "_id": 0}},
             ]
         )
-
-        logger.debug(f"{self.db_name}/{self.col_name}: search query results:")
-        count = 0
-        for r in result:
-            logger.debug(r)
-            count += 1
-
-        assert count == 4
diff --git a/docker/mongodb-kubernetes-tests/tests/common/search/search_tester.py b/docker/mongodb-kubernetes-tests/tests/common/search/search_tester.py
index bbca34b3b..8d8334ee9 100644
--- a/docker/mongodb-kubernetes-tests/tests/common/search/search_tester.py
+++ b/docker/mongodb-kubernetes-tests/tests/common/search/search_tester.py
@@ -15,8 +15,10 @@ class SearchTester(MongoTester):
     def __init__(
         self,
         connection_string: str,
+        use_ssl: bool = False,
+        ca_path: str | None = None,
     ):
-        super().__init__(connection_string, False)
+        super().__init__(connection_string, use_ssl, ca_path)
 
     def mongorestore_from_url(self, archive_url: str, ns_include: str, mongodb_tools_dir: str = ""):
         logger.debug(f"running mongorestore from {archive_url}")
@@ -26,6 +28,10 @@ def mongorestore_from_url(self, archive_url: str, ns_include: str, mongodb_tools
             logger.debug(f"Downloaded sample file from {archive_url} to {sample_file.name} (size: {size})")
             mongorestore_path = os.path.join(mongodb_tools_dir, "mongorestore")
             mongorestore_cmd = f"{mongorestore_path} --archive={sample_file.name} --verbose=1 --drop --nsInclude {ns_include} --uri={self.cnx_string}"
+            if self.default_opts.get("tls", False):
+                mongorestore_cmd += " --ssl"
+            if ca_path := self.default_opts.get("tlsCAFile"):
+                mongorestore_cmd += " --sslCAFile=" + ca_path
             process_run_and_check(mongorestore_cmd.split())
 
     def create_search_index(self, database_name: str, collection_name: str):
@@ -49,6 +55,10 @@ def wait_for_search_indexes_ready(self, database_name: str, collection_name: str
 
     def search_indexes_ready(self, database_name: str, collection_name: str):
         search_indexes = self.get_search_indexes(database_name, collection_name)
+        if len(search_indexes) == 0:
+            logger.error(f"There are no search indexes available in {database_name}.{collection_name}")
+            return False
+
         for idx in search_indexes:
             if idx.get("status") != "READY":
                 logger.debug(f"{database_name}/{collection_name}: search index {idx} is not ready")
diff --git a/docker/mongodb-kubernetes-tests/tests/search/fixtures/community-replicaset-sample-mflix.yaml b/docker/mongodb-kubernetes-tests/tests/search/fixtures/community-replicaset-sample-mflix.yaml
index 4ba3d40b6..fe54d614d 100644
--- a/docker/mongodb-kubernetes-tests/tests/search/fixtures/community-replicaset-sample-mflix.yaml
+++ b/docker/mongodb-kubernetes-tests/tests/search/fixtures/community-replicaset-sample-mflix.yaml
@@ -4,27 +4,16 @@ kind: MongoDBCommunity
 metadata:
   name: mdbc-rs
 spec:
-  members: 3
+  version: 8.0.10
   type: ReplicaSet
-  version: "8.0.5"
+  members: 3
   security:
     authentication:
-      modes: ["SCRAM"]
+      ignoreUnknownUsers: true
+      modes:
+        - SCRAM
   agent:
     logLevel: DEBUG
-  users:
-    - name: my-user
-      db: admin
-      passwordSecretRef: # a reference to the secret that will be used to generate the user's password
-        name: my-user-password
-      roles:
-        - name: clusterAdmin
-          db: admin
-        - name: userAdminAnyDatabase
-          db: admin
-        - name: readWrite
-          db: sample_mflix
-      scramCredentialsSecretName: my-scram
   statefulSet:
     spec:
       template:
@@ -33,16 +22,48 @@ spec:
             - name: mongod
               resources:
                 limits:
-                  cpu: "3"
-                  memory: 5Gi
-                requests:
                   cpu: "2"
-                  memory: 5Gi
+                  memory: 2Gi
+                requests:
+                  cpu: "1"
+                  memory: 1Gi
             - name: mongodb-agent
               resources:
                 limits:
-                  cpu: "3"
-                  memory: 5Gi
+                  cpu: "1"
+                  memory: 2Gi
                 requests:
-                  cpu: "2"
-                  memory: 5Gi
+                  cpu: "0.5"
+                  memory: 1Gi
+  users:
+    # admin user with root role
+    - name: mdb-admin
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-admin-user-password
+      scramCredentialsSecretName: mdb-admin-user
+      roles:
+        - name: root
+          db: admin
+    # user performing search queries
+    - name: mdb-user
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-user-password
+      scramCredentialsSecretName: mdb-user-scram
+      roles:
+        - name: restore
+          db: sample_mflix
+        - name: readWrite
+          db: sample_mflix
+    # user used by MongoDB Search to connect to MongoDB database to synchronize data from
+    # For MongoDB <8.2, the operator will be creating the searchCoordinator custom role automatically
+    # From MongoDB 8.2, searchCoordinator role will be a built-in role.
+    - name: search-sync-source
+      db: admin
+      passwordSecretRef: # a reference to the secret that will be used to generate the user's password
+        name: mdbc-rs-search-sync-source-password
+      scramCredentialsSecretName: mdbc-rs-search-sync-source
+      roles:
+        - name: searchCoordinator
+          db: admin
diff --git a/docker/mongodb-kubernetes-tests/tests/search/fixtures/search-with-user-password.yaml b/docker/mongodb-kubernetes-tests/tests/search/fixtures/search-with-user-password.yaml
new file mode 100644
index 000000000..33648e04a
--- /dev/null
+++ b/docker/mongodb-kubernetes-tests/tests/search/fixtures/search-with-user-password.yaml
@@ -0,0 +1,5 @@
+apiVersion: mongodb.com/v1
+kind: MongoDBSearch
+metadata:
+  name: mdbc-rs
+spec: {}
diff --git a/docker/mongodb-kubernetes-tests/tests/search/search_community_basic.py b/docker/mongodb-kubernetes-tests/tests/search/search_community_basic.py
index 69cbca895..97e9c1af7 100644
--- a/docker/mongodb-kubernetes-tests/tests/search/search_community_basic.py
+++ b/docker/mongodb-kubernetes-tests/tests/search/search_community_basic.py
@@ -12,21 +12,26 @@
 
 logger = test_logger.get_test_logger(__name__)
 
-USER_PASSWORD = "Passw0rd."
-USER_NAME = "my-user"
+ADMIN_USER_NAME = "mdb-admin-user"
+ADMIN_USER_PASSWORD = "mdb-admin-user-pass"
+
+MONGOT_USER_NAME = "search-sync-source"
+MONGOT_USER_PASSWORD = "search-sync-source-user-password"
+
+USER_NAME = "mdb-user"
+USER_PASSWORD = "mdb-user-pass"
+
 MDBC_RESOURCE_NAME = "mdbc-rs"
 
 
 @fixture(scope="function")
-def mdbc(namespace: str, custom_mdb_version: str) -> MongoDBCommunity:
+def mdbc(namespace: str) -> MongoDBCommunity:
     resource = MongoDBCommunity.from_yaml(
         yaml_fixture("community-replicaset-sample-mflix.yaml"),
         name=MDBC_RESOURCE_NAME,
         namespace=namespace,
     )
 
-    resource["spec"]["version"] = custom_mdb_version
-
     if try_load(resource):
         return resource
 
@@ -53,8 +58,14 @@ def test_install_operator(namespace: str, operator_installation_config: dict[str
 
 
 @mark.e2e_search_community_basic
-def test_install_secret(namespace: str):
-    create_or_update_secret(namespace=namespace, name="my-user-password", data={"password": USER_PASSWORD})
+def test_install_secrets(namespace: str, mdbs: MongoDBSearch):
+    create_or_update_secret(namespace=namespace, name=f"{USER_NAME}-password", data={"password": USER_PASSWORD})
+    create_or_update_secret(
+        namespace=namespace, name=f"{ADMIN_USER_NAME}-password", data={"password": ADMIN_USER_PASSWORD}
+    )
+    create_or_update_secret(
+        namespace=namespace, name=f"{mdbs.name}-{MONGOT_USER_NAME}-password", data={"password": MONGOT_USER_PASSWORD}
+    )
 
 
 @mark.e2e_search_community_basic
@@ -64,7 +75,7 @@ def test_create_database_resource(mdbc: MongoDBCommunity):
 
 
 @mark.e2e_search_community_basic
-def test_create_search_resource(mdbs: MongoDBSearch, mdbc: MongoDBCommunity):
+def test_create_search_resource(mdbs: MongoDBSearch):
     mdbs.update()
     mdbs.assert_reaches_phase(Phase.Running, timeout=300)
 
@@ -76,7 +87,9 @@ def test_wait_for_community_resource_ready(mdbc: MongoDBCommunity):
 
 @fixture(scope="function")
 def sample_movies_helper(mdbc: MongoDBCommunity) -> SampleMoviesSearchHelper:
-    return movies_search_helper.SampleMoviesSearchHelper(SearchTester(get_connection_string(mdbc)))
+    return movies_search_helper.SampleMoviesSearchHelper(
+        SearchTester(get_connection_string(mdbc, USER_NAME, USER_PASSWORD))
+    )
 
 
 @mark.e2e_search_community_basic
@@ -89,15 +102,10 @@ def test_search_create_search_index(sample_movies_helper: SampleMoviesSearchHelp
     sample_movies_helper.create_search_index()
 
 
-@mark.e2e_search_community_basic
-def test_search_wait_for_search_indexes(sample_movies_helper: SampleMoviesSearchHelper):
-    sample_movies_helper.wait_for_search_indexes()
-
-
 @mark.e2e_search_community_basic
 def test_search_assert_search_query(sample_movies_helper: SampleMoviesSearchHelper):
-    sample_movies_helper.assert_search_query()
+    sample_movies_helper.assert_search_query(retry_timeout=60)
 
 
-def get_connection_string(mdbc: MongoDBCommunity) -> str:
-    return f"mongodb://{USER_NAME}:{USER_PASSWORD}@{mdbc.name}-0.{mdbc.name}-svc.{mdbc.namespace}.svc.cluster.local:27017/?replicaSet={mdbc.name}"
+def get_connection_string(mdbc: MongoDBCommunity, user_name: str, user_password: str) -> str:
+    return f"mongodb://{user_name}:{user_password}@{mdbc.name}-0.{mdbc.name}-svc.{mdbc.namespace}.svc.cluster.local:27017/?replicaSet={mdbc.name}"
diff --git a/docker/mongodb-kubernetes-tests/tests/search/search_community_tls.py b/docker/mongodb-kubernetes-tests/tests/search/search_community_tls.py
new file mode 100644
index 000000000..44418b793
--- /dev/null
+++ b/docker/mongodb-kubernetes-tests/tests/search/search_community_tls.py
@@ -0,0 +1,173 @@
+import pymongo
+from kubetester import create_or_update_secret, try_load
+from kubetester.certs import create_tls_certs
+from kubetester.kubetester import fixture as yaml_fixture
+from kubetester.mongodb_community import MongoDBCommunity
+from kubetester.mongodb_search import MongoDBSearch
+from kubetester.phase import Phase
+from pytest import fixture, mark
+from tests import test_logger
+from tests.common.search import movies_search_helper
+from tests.common.search.movies_search_helper import SampleMoviesSearchHelper
+from tests.common.search.search_tester import SearchTester
+from tests.conftest import get_default_operator
+
+logger = test_logger.get_test_logger(__name__)
+
+ADMIN_USER_NAME = "mdb-admin-user"
+ADMIN_USER_PASSWORD = "mdb-admin-user-pass"
+
+MONGOT_USER_NAME = "search-sync-source"
+MONGOT_USER_PASSWORD = "search-sync-source-user-password"
+
+USER_NAME = "mdb-user"
+USER_PASSWORD = "mdb-user-pass"
+
+MDBC_RESOURCE_NAME = "mdbc-rs"
+
+TLS_SECRET_NAME = "tls-secret"
+
+# MongoDBSearch TLS configuration
+MDBS_TLS_SECRET_NAME = "mdbs-tls-secret"
+
+
+@fixture(scope="function")
+def mdbc(namespace: str) -> MongoDBCommunity:
+    resource = MongoDBCommunity.from_yaml(
+        yaml_fixture("community-replicaset-sample-mflix.yaml"),
+        name=MDBC_RESOURCE_NAME,
+        namespace=namespace,
+    )
+
+    if try_load(resource):
+        return resource
+
+    # Add TLS configuration
+    resource["spec"]["security"]["tls"] = {
+        "enabled": True,
+        "certificateKeySecretRef": {"name": TLS_SECRET_NAME},
+        "caCertificateSecretRef": {"name": TLS_SECRET_NAME},
+    }
+
+    return resource
+
+
+@fixture(scope="function")
+def mdbs(namespace: str) -> MongoDBSearch:
+    resource = MongoDBSearch.from_yaml(
+        yaml_fixture("search-minimal.yaml"),
+        namespace=namespace,
+    )
+
+    if try_load(resource):
+        return resource
+
+    # Add TLS configuration to MongoDBSearch
+    if "spec" not in resource:
+        resource["spec"] = {}
+
+    resource["spec"]["security"] = {"tls": {"enabled": True, "certificateKeySecretRef": {"name": MDBS_TLS_SECRET_NAME}}}
+
+    return resource
+
+
+@mark.e2e_search_community_tls
+def test_install_operator(namespace: str, operator_installation_config: dict[str, str]):
+    operator = get_default_operator(namespace, operator_installation_config=operator_installation_config)
+    operator.assert_is_running()
+
+
+@mark.e2e_search_community_tls
+def test_install_secrets(namespace: str, mdbs: MongoDBSearch):
+    # Create user password secrets
+    create_or_update_secret(namespace=namespace, name=f"{USER_NAME}-password", data={"password": USER_PASSWORD})
+    create_or_update_secret(
+        namespace=namespace, name=f"{ADMIN_USER_NAME}-password", data={"password": ADMIN_USER_PASSWORD}
+    )
+    create_or_update_secret(
+        namespace=namespace, name=f"{mdbs.name}-{MONGOT_USER_NAME}-password", data={"password": MONGOT_USER_PASSWORD}
+    )
+
+
+@mark.e2e_search_community_tls
+def test_install_tls_secrets_and_configmaps(namespace: str, mdbc: MongoDBCommunity, mdbs: MongoDBSearch, issuer: str):
+    create_tls_certs(issuer, namespace, mdbc.name, mdbc["spec"]["members"], secret_name=TLS_SECRET_NAME)
+
+    search_service_name = f"{mdbs.name}-search-svc"
+    create_tls_certs(
+        issuer,
+        namespace,
+        f"{mdbs.name}-search",
+        replicas=1,
+        service_name=search_service_name,
+        additional_domains=[f"{search_service_name}.{namespace}.svc.cluster.local"],
+        secret_name=MDBS_TLS_SECRET_NAME,
+    )
+
+
+@mark.e2e_search_community_tls
+def test_create_database_resource(mdbc: MongoDBCommunity):
+    mdbc.update()
+    mdbc.assert_reaches_phase(Phase.Running, timeout=1000)
+
+
+@mark.e2e_search_community_tls
+def test_create_search_resource(mdbs: MongoDBSearch):
+    mdbs.update()
+    mdbs.assert_reaches_phase(Phase.Running, timeout=300)
+
+
+@mark.e2e_search_community_tls
+def test_wait_for_community_resource_ready(mdbc: MongoDBCommunity):
+    mdbc.assert_reaches_phase(Phase.Running, timeout=1800)
+
+
+@mark.e2e_search_community_tls
+def test_validate_tls_connections(mdbc: MongoDBCommunity, mdbs: MongoDBSearch, namespace: str, issuer_ca_filepath: str):
+    with pymongo.MongoClient(
+        f"mongodb://{mdbc.name}-0.{mdbc.name}-svc.{namespace}.svc.cluster.local:27017/?replicaSet={mdbc.name}",
+        tls=True,
+        tlsCAFile=issuer_ca_filepath,
+        tlsAllowInvalidHostnames=False,
+        serverSelectionTimeoutMS=30000,
+        connectTimeoutMS=20000,
+    ) as mongodb_client:
+        mongodb_info = mongodb_client.admin.command("hello")
+        assert mongodb_info.get("ok") == 1, "MongoDBCommunity connection failed"
+
+    with pymongo.MongoClient(
+        f"mongodb://{mdbs.name}-search-svc.{namespace}.svc.cluster.local:27027",
+        tls=True,
+        tlsCAFile=issuer_ca_filepath,
+        tlsAllowInvalidHostnames=False,
+        serverSelectionTimeoutMS=10000,
+        connectTimeoutMS=10000,
+    ) as search_client:
+        search_info = search_client.admin.command("hello")
+        assert search_info.get("ok") == 1, "MongoDBSearch connection failed"
+
+
+@fixture(scope="function")
+def sample_movies_helper(mdbc: MongoDBCommunity, issuer_ca_filepath: str) -> SampleMoviesSearchHelper:
+    return movies_search_helper.SampleMoviesSearchHelper(
+        SearchTester(get_connection_string(mdbc, USER_NAME, USER_PASSWORD), use_ssl=True, ca_path=issuer_ca_filepath),
+    )
+
+
+@mark.e2e_search_community_tls
+def test_search_restore_sample_database(sample_movies_helper: SampleMoviesSearchHelper):
+    sample_movies_helper.restore_sample_database()
+
+
+@mark.e2e_search_community_tls
+def test_search_create_search_index(sample_movies_helper: SampleMoviesSearchHelper):
+    sample_movies_helper.create_search_index()
+
+
+@mark.e2e_search_community_tls
+def test_search_assert_search_query(sample_movies_helper: SampleMoviesSearchHelper):
+    sample_movies_helper.assert_search_query(retry_timeout=60)
+
+
+def get_connection_string(mdbc: MongoDBCommunity, user_name: str, user_password: str) -> str:
+    return f"mongodb://{user_name}:{user_password}@{mdbc.name}-0.{mdbc.name}-svc.{mdbc.namespace}.svc.cluster.local:27017/?replicaSet={mdbc.name}"
diff --git a/docs/community-search/quick-start/README.md b/docs/community-search/quick-start/README.md
index 3934db1ab..7f6b6af99 100644
--- a/docs/community-search/quick-start/README.md
+++ b/docs/community-search/quick-start/README.md
@@ -4,11 +4,9 @@ This guide provides instructions for deploying MongoDB Community Edition along w
 
 ## Prerequisites
 
-Community Search is currently in private preview, and access to the image requires a secret to pull the search container image from Quay.io. This secret is specified during the first step of the process below, and must be obtained from MongoDB when requesting access to the private preview.
-
 Before you begin, ensure you have the following tools and configurations in place:
 
-- **Kubernetes cluster**: A running Kubernetes cluster (e.g., Minikube, Kind, GKE, EKS, AKS).
+- **Kubernetes cluster**: A running Kubernetes cluster (e.g., Minikube, Kind, GKE, EKS, AKS) with kubeconfig available locally.
 - **kubectl**: The Kubernetes command-line tool, configured to communicate with your cluster.
 - **Helm**: The package manager for Kubernetes, used here to install the MongoDB Kubernetes Operator.
 - **Bash 5.1+**: All shell commands in this guide are intended to be run in Bash. Scripts in this guide are automatically tested on Linux with Bash 5.1.
@@ -29,15 +27,18 @@ Download or copy the content of `env_variables.sh`:
 # set it to the context name of the k8s cluster
 export K8S_CLUSTER_0_CONTEXT_NAME="<local cluster context>"
 
-# At the private preview stage the community search image is accessible only from a private repository.
-# Please contact MongoDB Support to get access.
-export PRIVATE_PREVIEW_IMAGE_PULLSECRET="<.dockerconfigjson>"
-
 # the following namespace will be created if not exists
 export MDB_NAMESPACE="mongodb"
 
+# minimum required MongoDB version for running MongoDB Search is 8.0.10
+export MDB_VERSION="8.0.10"
+
+# root admin user for convenience, not used here at all in this guide
 export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
-export MDB_SEARCH_USER_PASSWORD="search-user-password-CHANGE-ME"
+# regular user performing restore and search queries on sample mflix database
+export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
+# user for MongoDB Search to connect to the replica set to synchronise data from
+export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
 
 export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes"
 # comma-separated key=value pairs for additional parameters passed to the helm-chart installing the operator
@@ -69,83 +70,39 @@ helm upgrade --install --debug --kube-context "${K8S_CLUSTER_0_CONTEXT_NAME}" \
   --set "${OPERATOR_ADDITIONAL_HELM_VALUES:-"dummy=value"}" \
   "${OPERATOR_HELM_CHART}"
 ```
-This command installs the operator in the `mongodb` namespace (creating it if it doesn't exist) and names the release `community-operator`.
-
-### 4. Configure Pull Secret for MongoDB Community Search
-
-To use MongoDB Search, your Kubernetes cluster needs to pull the necessary container images. This step creates a Kubernetes secret named `community-private-preview-pullsecret`. This secret stores the credentials required to access the image repository for MongoDB Search. The script then patches the `mongodb-kubernetes-database-pods` service account to include this pull secret, allowing pods managed by this service account to pull the required images.
-
-[code_snippets/0200_configure_community_search_pullsecret.sh](code_snippets/0200_configure_community_search_pullsecret.sh)
-```shell copy
-kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
-apiVersion: v1
-kind: Secret
-metadata:
-  name: community-private-preview-pullsecret
-data:
-  .dockerconfigjson: "${PRIVATE_PREVIEW_IMAGE_PULLSECRET}"
-type: kubernetes.io/dockerconfigjson
-EOF
-
-pull_secrets=$(kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-  get sa mongodb-kubernetes-database-pods -n "${MDB_NAMESPACE}" -o=jsonpath='{.imagePullSecrets[*]}')
-
-if [[ "${pull_secrets}" ]]; then
-  kubectl patch --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-    sa mongodb-kubernetes-database-pods  \
-    --type=json -p='[{"op": "add", "path": "/imagePullSecrets/-", "value": {"name": "community-private-preview-pullsecret"}}]'
-else
-  kubectl patch --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-    sa mongodb-kubernetes-database-pods  \
-    --type=merge -p='{"imagePullSecrets": [{"name": "community-private-preview-pullsecret"}]}'
-fi
-echo "ServiceAccount mongodb-kubernetes-database-pods has been patched: "
-
-kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o yaml sa mongodb-kubernetes-database-pods
-```
-This script creates a `community-private-preview-pullsecret` secret in your Kubernetes namespace and associates it with the service account used for MongoDB pods.
-
-### 5. Verify Pull Secret Configuration
-
-Confirm that the `community-private-preview-pullsecret` has been successfully added to the `mongodb-kubernetes-database-pods` service account. This ensures that Kubernetes can authenticate with the container registry when pulling images for MongoDB Search pods.
-
-[code_snippets/0210_verify_community_search_pullsecret.sh](code_snippets/0210_verify_community_search_pullsecret.sh)
-```shell copy
-echo "Verifying mongodb-kubernetes-database-pods contains proper pull secret"
-if ! kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o json \
-  sa mongodb-kubernetes-database-pods -o=jsonpath='{.imagePullSecrets[*]}' | \
-    grep community-private-preview-pullsecret; then
-  echo "ERROR: mongodb-kubernetes-database-pods service account doesn't contain necessary pullsecret"
-  kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o json \
-    sa mongodb-kubernetes-database-pods -o=yaml
-  return 1
-fi
-```
-This command checks the `mongodb-kubernetes-database-pods` service account to confirm the presence of `community-private-preview-pullsecret`.
+This command installs the operator in the `mongodb` namespace (creating it if it doesn't exist).
 
 ## Creating a MongoDB Community Search Deployment
 
 With the prerequisites and initial setup complete, you can now deploy MongoDB Community Edition and enable Search.
 
-### 6. Create MongoDB User Secrets
+### 4. Create MongoDB User Secrets
 
 MongoDB requires authentication for secure access. This step creates two Kubernetes secrets: `admin-user-password` and `search-user-password`. These secrets store the credentials for the MongoDB administrative user and a dedicated search user, respectively. These secrets will be mounted into the MongoDB pods.
 
 [code_snippets/0305_create_mongodb_community_user_secrets.sh](code_snippets/0305_create_mongodb_community_user_secrets.sh)
 ```shell copy
 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
-  create secret generic admin-user-password \
+  create secret generic mdb-admin-user-password \
   --from-literal=password="${MDB_ADMIN_USER_PASSWORD}"
 
 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
-  create secret generic search-user-password \
-  --from-literal=password="${MDB_SEARCH_USER_PASSWORD}"
+  create secret generic mdbc-rs-search-sync-source-password \
+  --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}"
+
+kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
+  create secret generic mdb-user-password \
+  --from-literal=password="${MDB_USER_PASSWORD}"
+
 ```
 Ensure these secrets are created in the same namespace where you plan to deploy MongoDB.
 
-### 7. Create MongoDB Community Resource
+### 5. Create MongoDB Community Resource
 
-Now, deploy MongoDB Community by creating a `MongoDBCommunity` custom resource named `mdbc-rs`. This resource definition instructs the MongoDB Kubernetes Operator to configure a MongoDB replica set with 3 members, running version 8.0.6. MongoDB Community Search is supported only from MongoDB Community Server version 8.0. It also defines CPU and memory resources for the `mongod` and `mongodb-agent` containers, and sets up two users (`admin-user` and `search-user`) with their respective roles and password secrets. User `search-user` will be used to restore, connect and perform search queries on the `sample_mflix` database.
+Now, deploy MongoDB Community by creating a `MongoDBCommunity` custom resource named `mdbc-rs`. This resource definition instructs the MongoDB Kubernetes Operator to configure a MongoDB replica set with 3 members, running version 8.0.10. MongoDB Community Search is supported only from MongoDB Community Server version 8.0.10. It also defines CPU and memory resources for the `mongod` and `mongodb-agent` containers, and sets up three users:
+* `mdb-user` - a regular user used to that will perform restore of `sample_mflix` database and execute search queries.
+* `search-sync-source` - user that MongoDB Search is using to connect to MongoDB database in order to manage and build indexes. This user uses `searchCoordinator` role, which for MongoDB <8.2 is created automatically by the operator.
+* `admin-user` and ``) with their respective roles and password secrets. User `search-user` will be used to restore, connect and perform search queries on the `sample_mflix` database.
 
 [code_snippets/0310_create_mongodb_community_resource.sh](code_snippets/0310_create_mongodb_community_resource.sh)
 ```yaml copy
@@ -155,7 +112,7 @@ kind: MongoDBCommunity
 metadata:
   name: mdbc-rs
 spec:
-  version: 8.0.6
+  version: ${MDB_VERSION}
   type: ReplicaSet
   members: 3
   security:
@@ -164,7 +121,7 @@ spec:
       modes:
         - SCRAM
   agent:
-    logLevel: INFO
+    logLevel: DEBUG
   statefulSet:
     spec:
       template:
@@ -173,40 +130,55 @@ spec:
             - name: mongod
               resources:
                 limits:
-                  cpu: "3"
-                  memory: 5Gi
-                requests:
                   cpu: "2"
-                  memory: 5Gi
+                  memory: 2Gi
+                requests:
+                  cpu: "1"
+                  memory: 1Gi
             - name: mongodb-agent
               resources:
                 limits:
-                  cpu: "2"
-                  memory: 5Gi
-                requests:
                   cpu: "1"
-                  memory: 5Gi
+                  memory: 2Gi
+                requests:
+                  cpu: "0.5"
+                  memory: 1Gi
   users:
-    - name: admin-user
-      passwordSecretRef:
-        name: admin-user-password
+    # admin user with root role
+    - name: mdb-admin
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-admin-user-password
+      scramCredentialsSecretName: mdb-admin-user
+      roles:
+        - name: root
+          db: admin
+    # user performing search queries
+    - name: mdb-user
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-user-password
+      scramCredentialsSecretName: mdb-user-scram
       roles:
-        - db: admin
-          name: clusterAdmin
-        - db: admin
-          name: userAdminAnyDatabase
-      scramCredentialsSecretName: admin-user
-    - name: search-user
-      passwordSecretRef:
-        name: search-user-password
+        - name: restore
+          db: sample_mflix
+        - name: readWrite
+          db: sample_mflix
+    # user used by MongoDB Search to connect to MongoDB database to synchronize data from
+    # For MongoDB <8.2, the operator will be creating the searchCoordinator custom role automatically
+    # From MongoDB 8.2, searchCoordinator role will be a built-in role.
+    - name: search-sync-source
+      db: admin
+      passwordSecretRef: # a reference to the secret that will be used to generate the user's password
+        name: mdbc-rs-search-sync-source-password
+      scramCredentialsSecretName: mdbc-rs-search-sync-source
       roles:
-        - db: sample_mflix
-          name: dbOwner
-      scramCredentialsSecretName: search-user
+        - name: searchCoordinator
+          db: admin
 EOF
 ```
 
-### 8. Wait for MongoDB Community Resource to be Ready
+### 6. Wait for MongoDB Community Resource to be Ready
 
 After applying the `MongoDBCommunity` custom resource, the operator begins deploying the MongoDB nodes (pods). This step uses `kubectl wait` to pause execution until the `mdbc-rs` resource's status phase becomes `Running`, indicating that the MongoDB Community replica set is operational.
 
@@ -220,13 +192,12 @@ echo; echo "Pods running in cluster ${K8S_CLUSTER_0_CONTEXT_NAME}"
 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
 ```
 
-### 9. Create MongoDB Search Resource
+### 7. Create MongoDB Search Resource
 
 Once your MongoDB deployment is ready, enable Search capabilities by creating a `MongoDBSearch` custom resource, also named `mdbc-rs` to associate it with the MongoDB instance. This resource specifies the CPU and memory resource requirements for the search nodes.
 
-Note: Private preview of MongoDB Community Search comes with some limitations, and it is not suitable for production use:
-* TLS cannot be enabled in MongoDB Community deployment (MongoD communicates with MongoT with plain text).
-* Only one node of search node is supported (load balancing not supported)
+Note: Public Preview of MongoDB Community Search comes with some limitations, and it is not suitable for production use:
+* Only one instance of the search node is supported (load balancing is not supported)
 
 [code_snippets/0320_create_mongodb_search_resource.sh](code_snippets/0320_create_mongodb_search_resource.sh)
 ```shell copy
@@ -258,7 +229,7 @@ requests:
     memory: 2G
 ```
 
-### 10. Wait for Search Resource to be Ready
+### 8. Wait for Search Resource to be Ready
 
 Similar to the MongoDB deployment, the Search deployment needs time to initialize. This step uses `kubectl wait` to pause until the `MongoDBSearch` resource `mdbc-rs` reports a `Running` status in its `.status.phase` field, indicating that the search nodes are operational and integrated.
 
@@ -269,7 +240,7 @@ kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" wait --f
 ```
 This command polls the status of the `MongoDBSearch` resource `mdbc-rs`.
 
-### 11. Verify MongoDB Community Resource Status
+### 9. Verify MongoDB Community Resource Status
 
 Double-check the status of your `MongoDBCommunity` resource to ensure it remains healthy and that the integration with the Search resource is reflected if applicable.
 
@@ -280,7 +251,7 @@ kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" wait --f
 ```
 This provides a final confirmation that the core database is operational.
 
-### 12. List Running Pods
+### 10. List Running Pods
 
 View all the running pods in your namespace. You should see pods for the MongoDB replica set members, the MongoDB Kubernetes Operator, and the MongoDB Search nodes.
 
@@ -298,7 +269,7 @@ kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" get pods
 
 Now that your MongoDB Community database with Search is deployed, you can start using its search capabilities.
 
-### 13. Deploy MongoDB Tools Pod
+### 11. Deploy MongoDB Tools Pod
 
 To interact with your MongoDB deployment, this step deploys a utility pod named `mongodb-tools-pod`. This pod runs a MongoDB Community Server image and is kept running with a `sleep infinity` command, allowing you to use `kubectl exec` to run MongoDB client tools like `mongosh` and `mongorestore` from within the Kubernetes cluster. Running steps in a pod inside the cluster simplifies connectivity to mongodb without neeeding to expose the database externally (provided steps directly connect to the *.cluster.local hostnames).
 
@@ -316,7 +287,7 @@ metadata:
 spec:
   containers:
   - name: mongodb-tools
-    image: mongodb/mongodb-community-server:8.0.6-ubi9
+    image: mongodb/mongodb-community-server:${MDB_VERSION}-ubi8
     command: ["/bin/bash", "-c"]
     args: ["sleep infinity"]
   restartPolicy: Never
@@ -326,7 +297,7 @@ echo "Waiting for the mongodb-tools to be ready..."
 kubectl wait --for=condition=Ready pod/mongodb-tools-pod -n "${MDB_NAMESPACE}" --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --timeout=60s
 ```
 
-### 14. Import Sample Data
+### 12. Import Sample Data
 
 To test the search functionality, this step imports the `sample_mflix.movies` collection. It downloads the sample dataset and uses `mongorestore` to load the data into the `sample_mflix` database in your MongoDB deployment, connecting as the `search-user`.
 
@@ -338,13 +309,14 @@ kubectl exec -n "${MDB_NAMESPACE}" --context "${K8S_CLUSTER_0_CONTEXT_NAME}" mon
 echo "Downloading sample database archive..."
 curl https://atlas-education.s3.amazonaws.com/sample_mflix.archive -o /tmp/sample_mflix.archive
 echo "Restoring sample database"
-mongorestore --archive=/tmp/sample_mflix.archive --verbose=1 --drop --nsInclude 'sample_mflix.*' --uri="mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs"
+mongorestore --archive=/tmp/sample_mflix.archive --verbose=1 --drop --nsInclude 'sample_mflix.*' \
+--uri="mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs"
 EOF
 )"
 ```
 This command uses `mongorestore` from the `mongodb-tools-pod` to load data from the downloaded `sample_mflix.archive` file.
 
-### 15. Create Search Index
+### 13. Create Search Index
 
 Before performing search queries, create a search index. This step uses `kubectl exec` to run `mongosh` in the `mongodb-tools-pod`. It connects to the `sample_mflix` database as `search-user` and calls `db.movies.createSearchIndex()` to create a search index named "default" with dynamic mappings on the `movies` collection. Dynamic mapping automatically indexes all fields with supported types. MongoDB Search offers flexible index definitions, allowing for dynamic and static field mappings, various analyzer types (standard, language-specific, custom), and features like synonyms and faceted search.
 
@@ -353,12 +325,12 @@ Before performing search queries, create a search index. This step uses `kubectl
 #!/bin/bash
 
 kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- \
-  mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
+  mongosh --quiet "mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
     --eval "use sample_mflix" \
     --eval 'db.movies.createSearchIndex("default", { mappings: { dynamic: true } });'
 ```
 
-### 16. Wait for Search Index to be Ready
+### 14. Wait for Search Index to be Ready
 
 Creating a search index is an asynchronous operation. This script polls periodically the status by executing `db.movies.getSearchIndexes("default")`.
 
@@ -366,27 +338,12 @@ Creating a search index is an asynchronous operation. This script polls periodic
 ```shell copy
 #!/bin/bash
 
-for _ in $(seq 0 10); do
-  search_index_status=$(kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- \
-      mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
-        --eval "use sample_mflix" \
-        --eval 'db.movies.getSearchIndexes("default")[0]["status"]')
-
-  if [[ "${search_index_status}" == "READY" ]]; then
-    echo "Search index is ready."
-    break
-  fi
-  echo "Search index is not ready yet: status=${search_index_status}"
-  sleep 2
-done
-
-if [[ "${search_index_status}" != "READY" ]]; then
-  echo "Error waiting for the search index to be ready"
-  return 1
-fi
+# Currently it's not possible to check the status of search indexes, we need to just wait
+echo "Sleeping to wait for search indexes to be created"
+sleep 60
 ```
 
-### 17. Execute a Search Query
+### 15. Execute a Search Query
 
 Once the search index is ready, execute search queries using the `$search` aggregation pipeline stage. MongoDB Search supports a query language, allowing for various types of queries such as text search, autocomplete, faceting, and more. You can combine `$search` with other aggregation stages to further refine and process your results.
 
@@ -436,7 +393,7 @@ EOF
 
 kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- /bin/bash -eu -c "$(cat <<EOF
 echo '${mdb_script}' > /tmp/mdb_script.js
-mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" < /tmp/mdb_script.js
+mongosh --quiet "mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" < /tmp/mdb_script.js
 EOF
 )"
-```
\ No newline at end of file
+```
diff --git a/docs/community-search/quick-start/README.md.j2 b/docs/community-search/quick-start/README.md.j2
index 0e3125075..de32c88b1 100644
--- a/docs/community-search/quick-start/README.md.j2
+++ b/docs/community-search/quick-start/README.md.j2
@@ -4,11 +4,9 @@ This guide provides instructions for deploying MongoDB Community Edition along w
 
 ## Prerequisites
 
-Community Search is currently in private preview, and access to the image requires a secret to pull the search container image from Quay.io. This secret is specified during the first step of the process below, and must be obtained from MongoDB when requesting access to the private preview.
-
 Before you begin, ensure you have the following tools and configurations in place:
 
-- **Kubernetes cluster**: A running Kubernetes cluster (e.g., Minikube, Kind, GKE, EKS, AKS).
+- **Kubernetes cluster**: A running Kubernetes cluster (e.g., Minikube, Kind, GKE, EKS, AKS) with kubeconfig available locally.
 - **kubectl**: The Kubernetes command-line tool, configured to communicate with your cluster.
 - **Helm**: The package manager for Kubernetes, used here to install the MongoDB Kubernetes Operator.
 - **Bash 5.1+**: All shell commands in this guide are intended to be run in Bash. Scripts in this guide are automatically tested on Linux with Bash 5.1.
@@ -47,33 +45,13 @@ Next, install the MongoDB Kubernetes Operator from the Helm repository you just
 ```shell copy
 {% include "code_snippets/0100_install_operator.sh" %}
 ```
-This command installs the operator in the `mongodb` namespace (creating it if it doesn't exist) and names the release `community-operator`.
-
-### 4. Configure Pull Secret for MongoDB Community Search
-
-To use MongoDB Search, your Kubernetes cluster needs to pull the necessary container images. This step creates a Kubernetes secret named `community-private-preview-pullsecret`. This secret stores the credentials required to access the image repository for MongoDB Search. The script then patches the `mongodb-kubernetes-database-pods` service account to include this pull secret, allowing pods managed by this service account to pull the required images.
-
-[code_snippets/0200_configure_community_search_pullsecret.sh](code_snippets/0200_configure_community_search_pullsecret.sh)
-```shell copy
-{% include "code_snippets/0200_configure_community_search_pullsecret.sh" %}
-```
-This script creates a `community-private-preview-pullsecret` secret in your Kubernetes namespace and associates it with the service account used for MongoDB pods.
-
-### 5. Verify Pull Secret Configuration
-
-Confirm that the `community-private-preview-pullsecret` has been successfully added to the `mongodb-kubernetes-database-pods` service account. This ensures that Kubernetes can authenticate with the container registry when pulling images for MongoDB Search pods.
-
-[code_snippets/0210_verify_community_search_pullsecret.sh](code_snippets/0210_verify_community_search_pullsecret.sh)
-```shell copy
-{% include "code_snippets/0210_verify_community_search_pullsecret.sh" %}
-```
-This command checks the `mongodb-kubernetes-database-pods` service account to confirm the presence of `community-private-preview-pullsecret`.
+This command installs the operator in the `mongodb` namespace (creating it if it doesn't exist).
 
 ## Creating a MongoDB Community Search Deployment
 
 With the prerequisites and initial setup complete, you can now deploy MongoDB Community Edition and enable Search.
 
-### 6. Create MongoDB User Secrets
+### 4. Create MongoDB User Secrets
 
 MongoDB requires authentication for secure access. This step creates two Kubernetes secrets: `admin-user-password` and `search-user-password`. These secrets store the credentials for the MongoDB administrative user and a dedicated search user, respectively. These secrets will be mounted into the MongoDB pods.
 
@@ -83,16 +61,19 @@ MongoDB requires authentication for secure access. This step creates two Kuberne
 ```
 Ensure these secrets are created in the same namespace where you plan to deploy MongoDB.
 
-### 7. Create MongoDB Community Resource
+### 5. Create MongoDB Community Resource
 
-Now, deploy MongoDB Community by creating a `MongoDBCommunity` custom resource named `mdbc-rs`. This resource definition instructs the MongoDB Kubernetes Operator to configure a MongoDB replica set with 3 members, running version 8.0.6. MongoDB Community Search is supported only from MongoDB Community Server version 8.0. It also defines CPU and memory resources for the `mongod` and `mongodb-agent` containers, and sets up two users (`admin-user` and `search-user`) with their respective roles and password secrets. User `search-user` will be used to restore, connect and perform search queries on the `sample_mflix` database.
+Now, deploy MongoDB Community by creating a `MongoDBCommunity` custom resource named `mdbc-rs`. This resource definition instructs the MongoDB Kubernetes Operator to configure a MongoDB replica set with 3 members, running version 8.0.10. MongoDB Community Search is supported only from MongoDB Community Server version 8.0.10. It also defines CPU and memory resources for the `mongod` and `mongodb-agent` containers, and sets up three users:
+* `mdb-user` - a regular user used to that will perform restore of `sample_mflix` database and execute search queries.
+* `search-sync-source` - user that MongoDB Search is using to connect to MongoDB database in order to manage and build indexes. This user uses `searchCoordinator` role, which for MongoDB <8.2 is created automatically by the operator.
+* `admin-user` and ``) with their respective roles and password secrets. User `search-user` will be used to restore, connect and perform search queries on the `sample_mflix` database.
 
 [code_snippets/0310_create_mongodb_community_resource.sh](code_snippets/0310_create_mongodb_community_resource.sh)
 ```yaml copy
 {% include "code_snippets/0310_create_mongodb_community_resource.sh" %}
 ```
 
-### 8. Wait for MongoDB Community Resource to be Ready
+### 6. Wait for MongoDB Community Resource to be Ready
 
 After applying the `MongoDBCommunity` custom resource, the operator begins deploying the MongoDB nodes (pods). This step uses `kubectl wait` to pause execution until the `mdbc-rs` resource's status phase becomes `Running`, indicating that the MongoDB Community replica set is operational.
 
@@ -101,13 +82,12 @@ After applying the `MongoDBCommunity` custom resource, the operator begins deplo
 {% include "code_snippets/0315_wait_for_community_resource.sh" %}
 ```
 
-### 9. Create MongoDB Search Resource
+### 7. Create MongoDB Search Resource
 
 Once your MongoDB deployment is ready, enable Search capabilities by creating a `MongoDBSearch` custom resource, also named `mdbc-rs` to associate it with the MongoDB instance. This resource specifies the CPU and memory resource requirements for the search nodes.
 
-Note: Private preview of MongoDB Community Search comes with some limitations, and it is not suitable for production use:
-* TLS cannot be enabled in MongoDB Community deployment (MongoD communicates with MongoT with plain text).
-* Only one node of search node is supported (load balancing not supported)
+Note: Public Preview of MongoDB Community Search comes with some limitations, and it is not suitable for production use:
+* Only one instance of the search node is supported (load balancing is not supported)
 
 [code_snippets/0320_create_mongodb_search_resource.sh](code_snippets/0320_create_mongodb_search_resource.sh)
 ```shell copy
@@ -126,7 +106,7 @@ requests:
     memory: 2G
 ```
 
-### 10. Wait for Search Resource to be Ready
+### 8. Wait for Search Resource to be Ready
 
 Similar to the MongoDB deployment, the Search deployment needs time to initialize. This step uses `kubectl wait` to pause until the `MongoDBSearch` resource `mdbc-rs` reports a `Running` status in its `.status.phase` field, indicating that the search nodes are operational and integrated.
 
@@ -136,7 +116,7 @@ Similar to the MongoDB deployment, the Search deployment needs time to initializ
 ```
 This command polls the status of the `MongoDBSearch` resource `mdbc-rs`.
 
-### 11. Verify MongoDB Community Resource Status
+### 9. Verify MongoDB Community Resource Status
 
 Double-check the status of your `MongoDBCommunity` resource to ensure it remains healthy and that the integration with the Search resource is reflected if applicable.
 
@@ -146,7 +126,7 @@ Double-check the status of your `MongoDBCommunity` resource to ensure it remains
 ```
 This provides a final confirmation that the core database is operational.
 
-### 12. List Running Pods
+### 10. List Running Pods
 
 View all the running pods in your namespace. You should see pods for the MongoDB replica set members, the MongoDB Kubernetes Operator, and the MongoDB Search nodes.
 
@@ -159,7 +139,7 @@ View all the running pods in your namespace. You should see pods for the MongoDB
 
 Now that your MongoDB Community database with Search is deployed, you can start using its search capabilities.
 
-### 13. Deploy MongoDB Tools Pod
+### 11. Deploy MongoDB Tools Pod
 
 To interact with your MongoDB deployment, this step deploys a utility pod named `mongodb-tools-pod`. This pod runs a MongoDB Community Server image and is kept running with a `sleep infinity` command, allowing you to use `kubectl exec` to run MongoDB client tools like `mongosh` and `mongorestore` from within the Kubernetes cluster. Running steps in a pod inside the cluster simplifies connectivity to mongodb without neeeding to expose the database externally (provided steps directly connect to the *.cluster.local hostnames).
 
@@ -168,7 +148,7 @@ To interact with your MongoDB deployment, this step deploys a utility pod named
 {% include "code_snippets/0410_run_mongodb_tools_pod.sh" %}
 ```
 
-### 14. Import Sample Data
+### 12. Import Sample Data
 
 To test the search functionality, this step imports the `sample_mflix.movies` collection. It downloads the sample dataset and uses `mongorestore` to load the data into the `sample_mflix` database in your MongoDB deployment, connecting as the `search-user`.
 
@@ -178,7 +158,7 @@ To test the search functionality, this step imports the `sample_mflix.movies` co
 ```
 This command uses `mongorestore` from the `mongodb-tools-pod` to load data from the downloaded `sample_mflix.archive` file.
 
-### 15. Create Search Index
+### 13. Create Search Index
 
 Before performing search queries, create a search index. This step uses `kubectl exec` to run `mongosh` in the `mongodb-tools-pod`. It connects to the `sample_mflix` database as `search-user` and calls `db.movies.createSearchIndex()` to create a search index named "default" with dynamic mappings on the `movies` collection. Dynamic mapping automatically indexes all fields with supported types. MongoDB Search offers flexible index definitions, allowing for dynamic and static field mappings, various analyzer types (standard, language-specific, custom), and features like synonyms and faceted search.
 
@@ -187,7 +167,7 @@ Before performing search queries, create a search index. This step uses `kubectl
 {% include "code_snippets/0430_create_search_index.sh" %}
 ```
 
-### 16. Wait for Search Index to be Ready
+### 14. Wait for Search Index to be Ready
 
 Creating a search index is an asynchronous operation. This script polls periodically the status by executing `db.movies.getSearchIndexes("default")`.
 
@@ -196,7 +176,7 @@ Creating a search index is an asynchronous operation. This script polls periodic
 {% include "code_snippets/0440_wait_for_search_index_ready.sh" %}
 ```
 
-### 17. Execute a Search Query
+### 15. Execute a Search Query
 
 Once the search index is ready, execute search queries using the `$search` aggregation pipeline stage. MongoDB Search supports a query language, allowing for various types of queries such as text search, autocomplete, faceting, and more. You can combine `$search` with other aggregation stages to further refine and process your results.
 
diff --git a/docs/community-search/quick-start/code_snippets/0100_install_operator.sh b/docs/community-search/quick-start/code_snippets/0100_install_operator.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0200_configure_community_search_pullsecret.sh b/docs/community-search/quick-start/code_snippets/0200_configure_community_search_pullsecret.sh
deleted file mode 100644
index 59310c81f..000000000
--- a/docs/community-search/quick-start/code_snippets/0200_configure_community_search_pullsecret.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-kubectl apply --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -f - <<EOF
-apiVersion: v1
-kind: Secret
-metadata:
-  name: community-private-preview-pullsecret
-data:
-  .dockerconfigjson: "${PRIVATE_PREVIEW_IMAGE_PULLSECRET}"
-type: kubernetes.io/dockerconfigjson
-EOF
-
-pull_secrets=$(kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-  get sa mongodb-kubernetes-database-pods -n "${MDB_NAMESPACE}" -o=jsonpath='{.imagePullSecrets[*]}')
-
-if [[ "${pull_secrets}" ]]; then
-  kubectl patch --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-    sa mongodb-kubernetes-database-pods  \
-    --type=json -p='[{"op": "add", "path": "/imagePullSecrets/-", "value": {"name": "community-private-preview-pullsecret"}}]'
-else
-  kubectl patch --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" \
-    sa mongodb-kubernetes-database-pods  \
-    --type=merge -p='{"imagePullSecrets": [{"name": "community-private-preview-pullsecret"}]}'
-fi
-echo "ServiceAccount mongodb-kubernetes-database-pods has been patched: "
-
-kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o yaml sa mongodb-kubernetes-database-pods
diff --git a/docs/community-search/quick-start/code_snippets/0210_verify_community_search_pullsecret.sh b/docs/community-search/quick-start/code_snippets/0210_verify_community_search_pullsecret.sh
deleted file mode 100644
index 576824091..000000000
--- a/docs/community-search/quick-start/code_snippets/0210_verify_community_search_pullsecret.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-echo "Verifying mongodb-kubernetes-database-pods service account contains proper pull secret"
-if ! kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o json \
-  sa mongodb-kubernetes-database-pods -o=jsonpath='{.imagePullSecrets[*]}' | \
-    grep community-private-preview-pullsecret; then
-  echo "ERROR: mongodb-kubernetes-database-pods service account doesn't contain necessary pullsecret"
-  kubectl get --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" -o json \
-    sa mongodb-kubernetes-database-pods -o=yaml
-  return 1
-fi
-echo "SUCCESS: mongodb-kubernetes-database-pods service account contains proper pull secret"
diff --git a/docs/community-search/quick-start/code_snippets/0305_create_mongodb_community_user_secrets.sh b/docs/community-search/quick-start/code_snippets/0305_create_mongodb_community_user_secrets.sh
old mode 100644
new mode 100755
index 8298481e9..49b29b054
--- a/docs/community-search/quick-start/code_snippets/0305_create_mongodb_community_user_secrets.sh
+++ b/docs/community-search/quick-start/code_snippets/0305_create_mongodb_community_user_secrets.sh
@@ -1,7 +1,12 @@
 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
-  create secret generic admin-user-password \
+  create secret generic mdb-admin-user-password \
   --from-literal=password="${MDB_ADMIN_USER_PASSWORD}"
 
 kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
-  create secret generic search-user-password \
-  --from-literal=password="${MDB_SEARCH_USER_PASSWORD}"
+  create secret generic mdbc-rs-search-sync-source-password \
+  --from-literal=password="${MDB_SEARCH_SYNC_USER_PASSWORD}"
+
+kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" --namespace "${MDB_NAMESPACE}" \
+  create secret generic mdb-user-password \
+  --from-literal=password="${MDB_USER_PASSWORD}"
+
diff --git a/docs/community-search/quick-start/code_snippets/0310_create_mongodb_community_resource.sh b/docs/community-search/quick-start/code_snippets/0310_create_mongodb_community_resource.sh
old mode 100644
new mode 100755
index 5d1aa7919..c67eb2bc6
--- a/docs/community-search/quick-start/code_snippets/0310_create_mongodb_community_resource.sh
+++ b/docs/community-search/quick-start/code_snippets/0310_create_mongodb_community_resource.sh
@@ -4,7 +4,7 @@ kind: MongoDBCommunity
 metadata:
   name: mdbc-rs
 spec:
-  version: 8.0.6
+  version: ${MDB_VERSION}
   type: ReplicaSet
   members: 3
   security:
@@ -13,7 +13,7 @@ spec:
       modes:
         - SCRAM
   agent:
-    logLevel: INFO
+    logLevel: DEBUG
   statefulSet:
     spec:
       template:
@@ -22,34 +22,49 @@ spec:
             - name: mongod
               resources:
                 limits:
-                  cpu: "3"
-                  memory: 5Gi
-                requests:
                   cpu: "2"
-                  memory: 5Gi
+                  memory: 2Gi
+                requests:
+                  cpu: "1"
+                  memory: 1Gi
             - name: mongodb-agent
               resources:
                 limits:
-                  cpu: "2"
-                  memory: 5Gi
-                requests:
                   cpu: "1"
-                  memory: 5Gi
+                  memory: 2Gi
+                requests:
+                  cpu: "0.5"
+                  memory: 1Gi
   users:
-    - name: admin-user
-      passwordSecretRef:
-        name: admin-user-password
+    # admin user with root role
+    - name: mdb-admin
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-admin-user-password
+      scramCredentialsSecretName: mdb-admin-user
+      roles:
+        - name: root
+          db: admin
+    # user performing search queries
+    - name: mdb-user
+      db: admin
+      passwordSecretRef: # a reference to the secret containing user password
+        name: mdb-user-password
+      scramCredentialsSecretName: mdb-user-scram
       roles:
-        - db: admin
-          name: clusterAdmin
-        - db: admin
-          name: userAdminAnyDatabase
-      scramCredentialsSecretName: admin-user
-    - name: search-user
-      passwordSecretRef:
-        name: search-user-password
+        - name: restore
+          db: sample_mflix
+        - name: readWrite
+          db: sample_mflix
+    # user used by MongoDB Search to connect to MongoDB database to synchronize data from
+    # For MongoDB <8.2, the operator will be creating the searchCoordinator custom role automatically
+    # From MongoDB 8.2, searchCoordinator role will be a built-in role.
+    - name: search-sync-source
+      db: admin
+      passwordSecretRef: # a reference to the secret that will be used to generate the user's password
+        name: mdbc-rs-search-sync-source-password
+      scramCredentialsSecretName: mdbc-rs-search-sync-source
       roles:
-        - db: sample_mflix
-          name: dbOwner
-      scramCredentialsSecretName: search-user
+        - name: searchCoordinator
+          db: admin
 EOF
diff --git a/docs/community-search/quick-start/code_snippets/0315_wait_for_community_resource.sh b/docs/community-search/quick-start/code_snippets/0315_wait_for_community_resource.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0320_create_mongodb_search_resource.sh b/docs/community-search/quick-start/code_snippets/0320_create_mongodb_search_resource.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0325_wait_for_search_resource.sh b/docs/community-search/quick-start/code_snippets/0325_wait_for_search_resource.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0330_wait_for_community_resource.sh b/docs/community-search/quick-start/code_snippets/0330_wait_for_community_resource.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0335_show_running_pods.sh b/docs/community-search/quick-start/code_snippets/0335_show_running_pods.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/0410_run_mongodb_tools_pod.sh b/docs/community-search/quick-start/code_snippets/0410_run_mongodb_tools_pod.sh
old mode 100644
new mode 100755
index 8bf7ffc2e..a622b65cc
--- a/docs/community-search/quick-start/code_snippets/0410_run_mongodb_tools_pod.sh
+++ b/docs/community-search/quick-start/code_snippets/0410_run_mongodb_tools_pod.sh
@@ -10,7 +10,7 @@ metadata:
 spec:
   containers:
   - name: mongodb-tools
-    image: mongodb/mongodb-community-server:8.0.6-ubi9
+    image: mongodb/mongodb-community-server:${MDB_VERSION}-ubi8
     command: ["/bin/bash", "-c"]
     args: ["sleep infinity"]
   restartPolicy: Never
diff --git a/docs/community-search/quick-start/code_snippets/0420_import_movies_mflix_database.sh b/docs/community-search/quick-start/code_snippets/0420_import_movies_mflix_database.sh
old mode 100644
new mode 100755
index a4ec500a0..1a5a9a0e6
--- a/docs/community-search/quick-start/code_snippets/0420_import_movies_mflix_database.sh
+++ b/docs/community-search/quick-start/code_snippets/0420_import_movies_mflix_database.sh
@@ -4,6 +4,7 @@ kubectl exec -n "${MDB_NAMESPACE}" --context "${K8S_CLUSTER_0_CONTEXT_NAME}" mon
 echo "Downloading sample database archive..."
 curl https://atlas-education.s3.amazonaws.com/sample_mflix.archive -o /tmp/sample_mflix.archive
 echo "Restoring sample database"
-mongorestore --archive=/tmp/sample_mflix.archive --verbose=1 --drop --nsInclude 'sample_mflix.*' --uri="mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs"
+mongorestore --archive=/tmp/sample_mflix.archive --verbose=1 --drop --nsInclude 'sample_mflix.*' \
+--uri="mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs"
 EOF
 )"
diff --git a/docs/community-search/quick-start/code_snippets/0430_create_search_index.sh b/docs/community-search/quick-start/code_snippets/0430_create_search_index.sh
old mode 100644
new mode 100755
index 0e230dc93..fff44b983
--- a/docs/community-search/quick-start/code_snippets/0430_create_search_index.sh
+++ b/docs/community-search/quick-start/code_snippets/0430_create_search_index.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 
 kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- \
-  mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
+  mongosh --quiet "mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
     --eval "use sample_mflix" \
     --eval 'db.movies.createSearchIndex("default", { mappings: { dynamic: true } });'
diff --git a/docs/community-search/quick-start/code_snippets/0440_wait_for_search_index_ready.sh b/docs/community-search/quick-start/code_snippets/0440_wait_for_search_index_ready.sh
old mode 100644
new mode 100755
index f51a0bf1e..ccbfa840e
--- a/docs/community-search/quick-start/code_snippets/0440_wait_for_search_index_ready.sh
+++ b/docs/community-search/quick-start/code_snippets/0440_wait_for_search_index_ready.sh
@@ -1,20 +1,5 @@
 #!/bin/bash
 
-for _ in $(seq 0 10); do
-  search_index_status=$(kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- \
-      mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" \
-        --eval "use sample_mflix" \
-        --eval 'db.movies.getSearchIndexes("default")[0]["status"]')
-
-  if [[ "${search_index_status}" == "READY" ]]; then
-    echo "Search index is ready."
-    break
-  fi
-  echo "Search index is not ready yet: status=${search_index_status}"
-  sleep 2
-done
-
-if [[ "${search_index_status}" != "READY" ]]; then
-  echo "Error waiting for the search index to be ready"
-  return 1
-fi
+# Currently it's not possible to check the status of search indexes, we need to just wait
+echo "Sleeping to wait for search indexes to be created"
+sleep 60
diff --git a/docs/community-search/quick-start/code_snippets/0450_execute_search_query.sh b/docs/community-search/quick-start/code_snippets/0450_execute_search_query.sh
old mode 100644
new mode 100755
index 0c3797a0b..538e1063a
--- a/docs/community-search/quick-start/code_snippets/0450_execute_search_query.sh
+++ b/docs/community-search/quick-start/code_snippets/0450_execute_search_query.sh
@@ -42,6 +42,6 @@ EOF
 
 kubectl exec --context "${K8S_CLUSTER_0_CONTEXT_NAME}" -n "${MDB_NAMESPACE}" mongodb-tools-pod -- /bin/bash -eu -c "$(cat <<EOF
 echo '${mdb_script}' > /tmp/mdb_script.js
-mongosh --quiet "mongodb://search-user:${MDB_SEARCH_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" < /tmp/mdb_script.js
+mongosh --quiet "mongodb://mdb-user:${MDB_USER_PASSWORD}@mdbc-rs-0.mdbc-rs-svc.${MDB_NAMESPACE}.svc.cluster.local:27017/?replicaSet=mdbc-rs" < /tmp/mdb_script.js
 EOF
 )"
diff --git a/docs/community-search/quick-start/code_snippets/090_helm_add_mogodb_repo.sh b/docs/community-search/quick-start/code_snippets/090_helm_add_mogodb_repo.sh
old mode 100644
new mode 100755
diff --git a/docs/community-search/quick-start/code_snippets/9010_delete_namespace.sh b/docs/community-search/quick-start/code_snippets/9010_delete_namespace.sh
old mode 100644
new mode 100755
index 96db9a4b6..ed2d3046d
--- a/docs/community-search/quick-start/code_snippets/9010_delete_namespace.sh
+++ b/docs/community-search/quick-start/code_snippets/9010_delete_namespace.sh
@@ -1 +1 @@
-kubectl --context
+kubectl --context "${K8S_CLUSTER_0_CONTEXT_NAME}" delete namespace "${MDB_NAMESPACE}"
diff --git a/docs/community-search/quick-start/community_search_snippets_test.sh.run.log b/docs/community-search/quick-start/community_search_snippets_test.sh.run.log
deleted file mode 100644
index 643009e51..000000000
--- a/docs/community-search/quick-start/community_search_snippets_test.sh.run.log
+++ /dev/null
@@ -1,16 +0,0 @@
-090_helm_add_mogodb_repo
-0100_install_operator
-0200_configure_community_search_pullsecret
-0210_verify_community_search_pullsecret
-0305_create_mongodb_community_user_secrets
-0310_create_mongodb_community_resource
-0315_wait_for_community_resource
-0320_create_mongodb_search_resource
-0325_wait_for_search_resource
-0330_wait_for_community_resource
-0335_show_running_pods
-0410_run_mongodb_tools_pod
-0420_import_movies_mflix_database
-0430_create_search_index
-0440_wait_for_search_index_ready
-0450_execute_search_query
diff --git a/docs/community-search/quick-start/env_variables.sh b/docs/community-search/quick-start/env_variables.sh
index 0d0a98a5f..613b1461b 100644
--- a/docs/community-search/quick-start/env_variables.sh
+++ b/docs/community-search/quick-start/env_variables.sh
@@ -1,15 +1,18 @@
 # set it to the context name of the k8s cluster
 export K8S_CLUSTER_0_CONTEXT_NAME="<local cluster context>"
 
-# At the private preview stage the community search image is accessible only from a private repository.
-# Please contact MongoDB Support to get access.
-export PRIVATE_PREVIEW_IMAGE_PULLSECRET="<.dockerconfigjson>"
-
 # the following namespace will be created if not exists
 export MDB_NAMESPACE="mongodb"
 
+# minimum required MongoDB version for running MongoDB Search is 8.0.10
+export MDB_VERSION="8.0.10"
+
+# root admin user for convenience, not used here at all in this guide
 export MDB_ADMIN_USER_PASSWORD="admin-user-password-CHANGE-ME"
-export MDB_SEARCH_USER_PASSWORD="search-user-password-CHANGE-ME"
+# regular user performing restore and search queries on sample mflix database
+export MDB_USER_PASSWORD="mdb-user-password-CHANGE-ME"
+# user for MongoDB Search to connect to the replica set to synchronise data from
+export MDB_SEARCH_SYNC_USER_PASSWORD="search-sync-user-password-CHANGE-ME"
 
 export OPERATOR_HELM_CHART="mongodb/mongodb-kubernetes"
 # comma-separated key=value pairs for additional parameters passed to the helm-chart installing the operator
diff --git a/docs/community-search/quick-start/env_variables_e2e_private.sh b/docs/community-search/quick-start/env_variables_e2e_private.sh
index 7996f92a9..5b528437c 100644
--- a/docs/community-search/quick-start/env_variables_e2e_private.sh
+++ b/docs/community-search/quick-start/env_variables_e2e_private.sh
@@ -1,8 +1,7 @@
 export K8S_CLUSTER_0_CONTEXT_NAME="${CLUSTER_NAME}"
 
-export PRIVATE_PREVIEW_IMAGE_PULLSECRET="${COMMUNITY_PRIVATE_PREVIEW_PULLSECRET_DOCKERCONFIGJSON}"
-
-source scripts/funcs/operator_deployment
+source "${PROJECT_DIR}/scripts/funcs/operator_deployment"
+source "${PROJECT_DIR}/scripts/dev/contexts/e2e_mdb_community"
 OPERATOR_ADDITIONAL_HELM_VALUES="$(get_operator_helm_values | tr ' ' ',')"
 export OPERATOR_ADDITIONAL_HELM_VALUES
 export OPERATOR_HELM_CHART="${PROJECT_DIR}/helm_chart"
diff --git a/docs/community-search/quick-start/env_variables_e2e_private_dev.sh b/docs/community-search/quick-start/env_variables_e2e_private_dev.sh
new file mode 100644
index 000000000..89f8a3932
--- /dev/null
+++ b/docs/community-search/quick-start/env_variables_e2e_private_dev.sh
@@ -0,0 +1,33 @@
+export K8S_CLUSTER_0_CONTEXT_NAME="kind-kind"
+
+# patch id from evergreen patch
+version_id="68876175f5ad6d0007fdc1d4"
+
+search_image_repo="268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot"
+search_image_hash="fbd60fb055dd500058edcb45677ea85d19421f47"
+
+ecr="268558157000.dkr.ecr.us-east-1.amazonaws.com"
+declare -a helm_values=(
+"registry.imagePullSecrets=image-registries-secret"
+"registry.operator=${ecr}/dev"
+"registry.initOpsManager=${ecr}/dev"
+"registry.initAppDb=${ecr}/dev"
+"registry.initDatabase=${ecr}/dev"
+"registry.agent=${ecr}/dev"
+"registry.opsManager=quay.io/mongodb"
+"registry.appDb=quay.io/mongodb"
+"registry.database=${ecr}/dev"
+"operator.version=${version_id}"
+"initOpsManager.version=${version_id}"
+"initAppDb.version=${version_id}"
+"initDatabase.version=${version_id}"
+"database.version=${version_id}"
+"search.community.repo=${search_image_repo}"
+"search.community.name=community"
+"search.community.version=${search_image_hash}"
+)
+
+OPERATOR_ADDITIONAL_HELM_VALUES="$(echo -n "${helm_values[@]}" | tr ' ' ',')"
+export OPERATOR_ADDITIONAL_HELM_VALUES
+OPERATOR_HELM_CHART="$(realpath "../../../helm_chart")"
+export OPERATOR_HELM_CHART
diff --git a/docs/community-search/quick-start/output/0100_install_operator.out b/docs/community-search/quick-start/output/0100_install_operator.out
index 035e24e8a..95eb4ab71 100644
--- a/docs/community-search/quick-start/output/0100_install_operator.out
+++ b/docs/community-search/quick-start/output/0100_install_operator.out
@@ -1,12 +1,36 @@
 Release "mongodb-kubernetes" does not exist. Installing it now.
 NAME: mongodb-kubernetes
-LAST DEPLOYED: Tue Jul  8 07:04:51 2025
+LAST DEPLOYED: Mon Jul 28 15:07:59 2025
 NAMESPACE: mongodb
 STATUS: deployed
 REVISION: 1
 TEST SUITE: None
 USER-SUPPLIED VALUES:
-dummy: value
+database:
+  version: 68876175f5ad6d0007fdc1d4
+initAppDb:
+  version: 68876175f5ad6d0007fdc1d4
+initDatabase:
+  version: 68876175f5ad6d0007fdc1d4
+initOpsManager:
+  version: 68876175f5ad6d0007fdc1d4
+operator:
+  version: 68876175f5ad6d0007fdc1d4
+registry:
+  agent: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  appDb: quay.io/mongodb
+  database: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  imagePullSecrets: image-registries-secret
+  initAppDb: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  initDatabase: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  initOpsManager: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  operator: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  opsManager: quay.io/mongodb
+search:
+  community:
+    name: community
+    repo: 268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot
+    version: fbd60fb055dd500058edcb45677ea85d19421f47
 
 COMPUTED VALUES:
 agent:
@@ -39,17 +63,16 @@ community:
     version: 4.4.0
 database:
   name: mongodb-kubernetes-database
-  version: 1.2.0
-dummy: value
+  version: 68876175f5ad6d0007fdc1d4
 initAppDb:
   name: mongodb-kubernetes-init-appdb
-  version: 1.2.0
+  version: 68876175f5ad6d0007fdc1d4
 initDatabase:
   name: mongodb-kubernetes-init-database
-  version: 1.2.0
+  version: 68876175f5ad6d0007fdc1d4
 initOpsManager:
   name: mongodb-kubernetes-init-ops-manager
-  version: 1.2.0
+  version: 68876175f5ad6d0007fdc1d4
 managedSecurityContext: false
 mongodb:
   appdbAssumeOldFormat: false
@@ -96,7 +119,7 @@ operator:
   vaultSecretBackend:
     enabled: false
     tlsSecretRef: ""
-  version: 1.2.0
+  version: 68876175f5ad6d0007fdc1d4
   watchedResources:
   - mongodb
   - opsmanagers
@@ -112,24 +135,23 @@ readinessProbe:
   name: mongodb-kubernetes-readinessprobe
   version: 1.0.22
 registry:
-  agent: quay.io/mongodb
+  agent: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
   appDb: quay.io/mongodb
-  database: quay.io/mongodb
-  imagePullSecrets: null
-  initAppDb: quay.io/mongodb
-  initDatabase: quay.io/mongodb
-  initOpsManager: quay.io/mongodb
-  operator: quay.io/mongodb
+  database: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  imagePullSecrets: image-registries-secret
+  initAppDb: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  initDatabase: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  initOpsManager: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
+  operator: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev
   opsManager: quay.io/mongodb
   pullPolicy: Always
   readinessProbe: quay.io/mongodb
   versionUpgradeHook: quay.io/mongodb
 search:
   community:
-    name: mongodb-search-community
-    repo: quay.io/mongodb
-    version: 1.47.0
-subresourceEnabled: true
+    name: community
+    repo: 268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot
+    version: fbd60fb055dd500058edcb45677ea85d19421f47
 versionUpgradeHook:
   name: mongodb-kubernetes-operator-version-upgrade-post-start-hook
   version: 1.0.9
@@ -143,6 +165,8 @@ kind: ServiceAccount
 metadata:
   name: mongodb-kubernetes-appdb
   namespace: mongodb
+imagePullSecrets:
+  - name: image-registries-secret
 ---
 # Source: mongodb-kubernetes/templates/database-roles.yaml
 apiVersion: v1
@@ -150,6 +174,8 @@ kind: ServiceAccount
 metadata:
   name: mongodb-kubernetes-database-pods
   namespace: mongodb
+imagePullSecrets:
+  - name: image-registries-secret
 ---
 # Source: mongodb-kubernetes/templates/database-roles.yaml
 apiVersion: v1
@@ -157,6 +183,8 @@ kind: ServiceAccount
 metadata:
   name: mongodb-kubernetes-ops-manager
   namespace: mongodb
+imagePullSecrets:
+  - name: image-registries-secret
 ---
 # Source: mongodb-kubernetes/templates/operator-sa.yaml
 apiVersion: v1
@@ -164,8 +192,10 @@ kind: ServiceAccount
 metadata:
   name: mongodb-kubernetes-operator
   namespace: mongodb
+imagePullSecrets:
+  - name: image-registries-secret
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -178,34 +208,7 @@ rules:
     resources:
       - clustermongodbroles
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: mongodb-kubernetes-operator-mongodb-webhook
-rules:
-  - apiGroups:
-      - "admissionregistration.k8s.io"
-    resources:
-      - validatingwebhookconfigurations
-    verbs:
-      - get
-      - create
-      - update
-      - delete
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - delete
----
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
 # Additional ClusterRole for clusterVersionDetection
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
@@ -233,7 +236,34 @@ rules:
     verbs:
       - list
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: mongodb-kubernetes-operator-mongodb-webhook
+rules:
+  - apiGroups:
+      - "admissionregistration.k8s.io"
+    resources:
+      - validatingwebhookconfigurations
+    verbs:
+      - get
+      - create
+      - update
+      - delete
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+      - create
+      - update
+      - delete
+---
+# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -247,30 +277,30 @@ subjects:
     name: mongodb-kubernetes-operator
     namespace: mongodb
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
+# ClusterRoleBinding for clusterVersionDetection
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: mongodb-kubernetes-operator-mongodb-webhook-binding
+  name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: mongodb-kubernetes-operator-mongodb-webhook
+  name: mongodb-kubernetes-operator-cluster-telemetry
 subjects:
   - kind: ServiceAccount
     name: mongodb-kubernetes-operator
     namespace: mongodb
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
-# ClusterRoleBinding for clusterVersionDetection
+# Source: mongodb-kubernetes/templates/operator-roles-webhook.yaml
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
+  name: mongodb-kubernetes-operator-mongodb-webhook-binding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: mongodb-kubernetes-operator-cluster-telemetry
+  name: mongodb-kubernetes-operator-mongodb-webhook
 subjects:
   - kind: ServiceAccount
     name: mongodb-kubernetes-operator
@@ -298,7 +328,7 @@ rules:
       - delete
       - get
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -378,7 +408,14 @@ rules:
       - opsmanagers/status
       - mongodbmulticluster/status
       - mongodbsearch/status
-
+---
+# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: mongodb-kubernetes-operator-pvc-resize
+  namespace: mongodb
+rules:
   - apiGroups:
       - ''
     resources:
@@ -406,7 +443,7 @@ subjects:
     name: mongodb-kubernetes-appdb
     namespace: mongodb
 ---
-# Source: mongodb-kubernetes/templates/operator-roles.yaml
+# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
@@ -421,6 +458,21 @@ subjects:
     name: mongodb-kubernetes-operator
     namespace: mongodb
 ---
+# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: mongodb-kubernetes-operator-pvc-resize-binding
+  namespace: mongodb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mongodb-kubernetes-operator-pvc-resize
+subjects:
+  - kind: ServiceAccount
+    name: mongodb-kubernetes-operator
+    namespace: mongodb
+---
 # Source: mongodb-kubernetes/templates/operator.yaml
 apiVersion: apps/v1
 kind: Deployment
@@ -445,9 +497,11 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 2000
+      imagePullSecrets:
+        - name: image-registries-secret
       containers:
         - name: mongodb-kubernetes-operator
-          image: "quay.io/mongodb/mongodb-kubernetes:1.2.0"
+          image: "268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-kubernetes:68876175f5ad6d0007fdc1d4"
           imagePullPolicy: Always
           args:
             - -watch-resource=mongodb
@@ -488,31 +542,31 @@ spec:
               value: Always
             # Database
             - name: MONGODB_ENTERPRISE_DATABASE_IMAGE
-              value: quay.io/mongodb/mongodb-kubernetes-database
+              value: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-kubernetes-database
             - name: INIT_DATABASE_IMAGE_REPOSITORY
-              value: quay.io/mongodb/mongodb-kubernetes-init-database
+              value: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-kubernetes-init-database
             - name: INIT_DATABASE_VERSION
-              value: 1.2.0
+              value: 68876175f5ad6d0007fdc1d4
             - name: DATABASE_VERSION
-              value: 1.2.0
+              value: 68876175f5ad6d0007fdc1d4
             # Ops Manager
             - name: OPS_MANAGER_IMAGE_REPOSITORY
               value: quay.io/mongodb/mongodb-enterprise-ops-manager-ubi
             - name: INIT_OPS_MANAGER_IMAGE_REPOSITORY
-              value: quay.io/mongodb/mongodb-kubernetes-init-ops-manager
+              value: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-kubernetes-init-ops-manager
             - name: INIT_OPS_MANAGER_VERSION
-              value: 1.2.0
+              value: 68876175f5ad6d0007fdc1d4
             # AppDB
             - name: INIT_APPDB_IMAGE_REPOSITORY
-              value: quay.io/mongodb/mongodb-kubernetes-init-appdb
+              value: 268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-kubernetes-init-appdb
             - name: INIT_APPDB_VERSION
-              value: 1.2.0
+              value: 68876175f5ad6d0007fdc1d4
             - name: OPS_MANAGER_IMAGE_PULL_POLICY
               value: Always
             - name: AGENT_IMAGE
-              value: "quay.io/mongodb/mongodb-agent-ubi:108.0.2.8729-1"
+              value: "268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-agent-ubi:108.0.2.8729-1"
             - name: MDB_AGENT_IMAGE_REPOSITORY
-              value: "quay.io/mongodb/mongodb-agent-ubi"
+              value: "268558157000.dkr.ecr.us-east-1.amazonaws.com/dev/mongodb-agent-ubi"
             - name: MONGODB_IMAGE
               value: mongodb-enterprise-server
             - name: MONGODB_REPO_URL
@@ -521,6 +575,8 @@ spec:
               value: ubi8
             - name: PERFORM_FAILOVER
               value: 'true'
+            - name: IMAGE_PULL_SECRETS
+              value: image-registries-secret
             - name: MDB_MAX_CONCURRENT_RECONCILES
               value: "1"
             - name: POD_NAME
@@ -544,9 +600,9 @@ spec:
               value: "ubi8"
             # Community Env Vars End
             - name: MDB_SEARCH_COMMUNITY_REPO_URL
-              value: "quay.io/mongodb"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot"
             - name: MDB_SEARCH_COMMUNITY_NAME
-              value: "mongodb-search-community"
+              value: "community"
             - name: MDB_SEARCH_COMMUNITY_VERSION
-              value: "1.47.0"
+              value: "fbd60fb055dd500058edcb45677ea85d19421f47"
 
diff --git a/docs/community-search/quick-start/output/0200_configure_community_search_pullsecret.out b/docs/community-search/quick-start/output/0200_configure_community_search_pullsecret.out
deleted file mode 100644
index c04db5317..000000000
--- a/docs/community-search/quick-start/output/0200_configure_community_search_pullsecret.out
+++ /dev/null
@@ -1,18 +0,0 @@
-secret/community-private-preview-pullsecret created
-serviceaccount/mongodb-kubernetes-database-pods patched
-ServiceAccount mongodb-kubernetes-database-pods has been patched: 
-apiVersion: v1
-imagePullSecrets:
-- name: community-private-preview-pullsecret
-kind: ServiceAccount
-metadata:
-  annotations:
-    meta.helm.sh/release-name: mongodb-kubernetes
-    meta.helm.sh/release-namespace: mongodb
-  creationTimestamp: "2025-07-08T07:04:51Z"
-  labels:
-    app.kubernetes.io/managed-by: Helm
-  name: mongodb-kubernetes-database-pods
-  namespace: mongodb
-  resourceVersion: "902"
-  uid: 69ba91c9-2032-48dd-8490-b1b6b1c82625
diff --git a/docs/community-search/quick-start/output/0210_verify_community_search_pullsecret.out b/docs/community-search/quick-start/output/0210_verify_community_search_pullsecret.out
deleted file mode 100644
index 80aafdc2d..000000000
--- a/docs/community-search/quick-start/output/0210_verify_community_search_pullsecret.out
+++ /dev/null
@@ -1,3 +0,0 @@
-Verifying mongodb-kubernetes-database-pods service account contains proper pull secret
-{"name":"community-private-preview-pullsecret"}
-SUCCESS: mongodb-kubernetes-database-pods service account contains proper pull secret
diff --git a/docs/community-search/quick-start/output/0335_show_running_pods.out b/docs/community-search/quick-start/output/0335_show_running_pods.out
index bca15125b..cd7017404 100644
--- a/docs/community-search/quick-start/output/0335_show_running_pods.out
+++ b/docs/community-search/quick-start/output/0335_show_running_pods.out
@@ -1,16 +1,20 @@
 
 MongoDBCommunity resource
 NAME      PHASE     VERSION
-mdbc-rs   Running   8.0.6
+mdbc-rs   Running   8.0.10
 
 MongoDBSearch resource
 NAME      PHASE     AGE
-mdbc-rs   Running   5m21s
+mdbc-rs   Running   7m58s
 
 Pods running in cluster kind-kind
 NAME                                           READY   STATUS    RESTARTS        AGE
-mdbc-rs-0                                      2/2     Running   1 (35s ago)     7m51s
-mdbc-rs-1                                      2/2     Running   1 (3m11s ago)   6m45s
-mdbc-rs-2                                      2/2     Running   1 (114s ago)    5m57s
-mdbc-rs-search-0                               1/1     Running   0               5m21s
-mongodb-kubernetes-operator-64d5b47b46-fd6nr   1/1     Running   0               7m54s
+mdb-debug-mdbc-rs-0-0                          1/1     Running   0               10m
+mdb-debug-mdbc-rs-1-0                          1/1     Running   0               10m
+mdb-debug-mdbc-rs-2-0                          1/1     Running   0               10m
+mdb-debug-mdbc-rs-search-0-0                   1/1     Running   0               7m57s
+mdbc-rs-0                                      2/2     Running   1 (3m13s ago)   10m
+mdbc-rs-1                                      2/2     Running   1 (5m49s ago)   9m23s
+mdbc-rs-2                                      2/2     Running   1 (4m32s ago)   8m35s
+mdbc-rs-search-0                               1/1     Running   0               25s
+mongodb-kubernetes-operator-5776c8b4df-wm82f   1/1     Running   0               35s
diff --git a/docs/community-search/quick-start/output/0440_wait_for_search_index_ready.out b/docs/community-search/quick-start/output/0440_wait_for_search_index_ready.out
index 17d0d593b..b264580af 100644
--- a/docs/community-search/quick-start/output/0440_wait_for_search_index_ready.out
+++ b/docs/community-search/quick-start/output/0440_wait_for_search_index_ready.out
@@ -1,4 +1 @@
-Search index is not ready yet: status=BUILDING
-Search index is not ready yet: status=BUILDING
-Search index is not ready yet: status=BUILDING
-Search index is ready.
+Sleeping to wait for search indexes to be created
diff --git a/docs/community-search/quick-start/output/090_helm_add_mogodb_repo.out b/docs/community-search/quick-start/output/090_helm_add_mogodb_repo.out
index e8630fdff..b1576c236 100644
--- a/docs/community-search/quick-start/output/090_helm_add_mogodb_repo.out
+++ b/docs/community-search/quick-start/output/090_helm_add_mogodb_repo.out
@@ -1,4 +1,4 @@
-"mongodb" has been added to your repositories
+"mongodb" already exists with the same configuration, skipping
 Hang tight while we grab the latest from your chart repositories...
 ...Successfully got an update from the "mongodb" chart repository
 Update Complete. ⎈Happy Helming!⎈
diff --git a/docs/community-search/quick-start/test.sh b/docs/community-search/quick-start/test.sh
index 15caf5fe4..86fb6b23e 100755
--- a/docs/community-search/quick-start/test.sh
+++ b/docs/community-search/quick-start/test.sh
@@ -5,7 +5,7 @@ set -eou pipefail
 script_name=$(readlink -f "${BASH_SOURCE[0]}")
 script_dir=$(dirname "${script_name}")
 
-source scripts/code_snippets/sample_test_runner.sh
+source "${script_dir}/../../../scripts/code_snippets/sample_test_runner.sh"
 
 cd "${script_dir}"
 
@@ -16,8 +16,6 @@ run 0046_create_image_pull_secrets.sh
 
 run_for_output 090_helm_add_mogodb_repo.sh
 run_for_output 0100_install_operator.sh
-run_for_output 0200_configure_community_search_pullsecret.sh
-run_for_output 0210_verify_community_search_pullsecret.sh
 run 0305_create_mongodb_community_user_secrets.sh
 run 0310_create_mongodb_community_resource.sh
 run 0315_wait_for_community_resource.sh
diff --git a/helm_chart/crds/mongodb.com_mongodbsearch.yaml b/helm_chart/crds/mongodb.com_mongodbsearch.yaml
index 272e7bc59..585b69210 100644
--- a/helm_chart/crds/mongodb.com_mongodbsearch.yaml
+++ b/helm_chart/crds/mongodb.com_mongodbsearch.yaml
@@ -149,6 +149,37 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
+              security:
+                properties:
+                  tls:
+                    properties:
+                      certificateKeySecretRef:
+                        description: |-
+                          CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
+                          The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
+                          This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
+                          Alternatively, an entry tls.pem, containing the concatenation of cert and key, can be provided.
+                          If all of tls.pem, tls.crt and tls.key are present, the tls.pem one needs to be equal to the concatenation of tls.crt and tls.key
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              TODO: Add other useful fields. apiVersion, kind, uid?
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      enabled:
+                        type: boolean
+                    required:
+                    - enabled
+                    type: object
+                type: object
               source:
                 properties:
                   mongodbResourceRef:
@@ -160,6 +191,21 @@ spec:
                     required:
                     - name
                     type: object
+                  passwordSecretRef:
+                    description: |-
+                      SecretKeyRef is a reference to a value in a given secret in the same
+                      namespace. Based on:
+                      https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#secretkeyselector-v1-core
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  username:
+                    type: string
                 type: object
               statefulSet:
                 description: |-
diff --git a/helm_chart/values.yaml b/helm_chart/values.yaml
index 0a44d5ca0..ebb8bd1c4 100644
--- a/helm_chart/values.yaml
+++ b/helm_chart/values.yaml
@@ -222,7 +222,11 @@ community:
 search:
   community:
     # Full Search container image url used for the MongoDB Community Search container will be constructed as {search.community.repo}/{search.community.name}:{search.community.version}
-    repo: quay.io/mongodb
-    name: mongodb-search-community
+#    repo: quay.io/mongodb
+#    name: mongodb-search-community
+#    # default MongoDB Search version used; can be overridden by setting MongoDBSearch.spec.version field.
+#    version: 1.47.0
+    repo: 268558157000.dkr.ecr.eu-west-1.amazonaws.com
+    name: mongot/community
     # default MongoDB Search version used; can be overridden by setting MongoDBSearch.spec.version field.
     version: 1.47.0
diff --git a/mongodb-community-operator/controllers/replica_set_controller.go b/mongodb-community-operator/controllers/replica_set_controller.go
index 6c0190fb0..644719294 100644
--- a/mongodb-community-operator/controllers/replica_set_controller.go
+++ b/mongodb-community-operator/controllers/replica_set_controller.go
@@ -14,6 +14,7 @@ import (
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
 	"sigs.k8s.io/controller-runtime/pkg/controller"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -727,6 +728,7 @@ func (r ReplicaSetReconciler) buildAutomationConfig(ctx context.Context, mdb mdb
 		prometheusModification,
 		processPortManager.GetPortsModification(),
 		getMongodConfigSearchModification(search),
+		searchCoordinatorCustomRoleModification(search),
 	)
 	if err != nil {
 		return automationconfig.AutomationConfig{}, fmt.Errorf("could not create an automation config: %s", err)
@@ -739,6 +741,66 @@ func (r ReplicaSetReconciler) buildAutomationConfig(ctx context.Context, mdb mdb
 	return automationConfig, nil
 }
 
+// TODO: remove this as soon as searchCoordinator builtin role is backported
+func searchCoordinatorCustomRoleModification(search *searchv1.MongoDBSearch) automationconfig.Modification {
+	if search == nil {
+		return automationconfig.NOOP()
+	}
+
+	return func(ac *automationconfig.AutomationConfig) {
+		searchCoordinatorRole := searchCoordinatorCustomRoleStruct()
+		ac.Roles = append(ac.Roles, searchCoordinatorRole)
+	}
+}
+
+func searchCoordinatorCustomRoleStruct() automationconfig.CustomRole {
+	// direct translation of https://github.com/10gen/mongo/blob/6f8d95a513eea8f91ea9f5d895dd8a288dfcf725/src/mongo/db/auth/builtin_roles.yml#L652
+	return automationconfig.CustomRole{
+		Role: "searchCoordinator",
+		DB:   "admin",
+		Roles: []automationconfig.Role{
+			{
+				Role:     "clusterMonitor",
+				Database: "admin",
+			},
+			{
+				Role:     "directShardOperations",
+				Database: "admin",
+			},
+			{
+				Role:     "readAnyDatabase",
+				Database: "admin",
+			},
+		},
+		Privileges: []automationconfig.Privilege{
+			{
+				Resource: automationconfig.Resource{
+					DB:         ptr.To("__mdb_internal_search"),
+					Collection: ptr.To(""),
+				},
+				Actions: []string{
+					"changeStream", "collStats", "dbHash", "dbStats", "find",
+					"killCursors", "listCollections", "listIndexes", "listSearchIndexes",
+					// performRawDataOperations is available only on mongod master
+					// "performRawDataOperations",
+					"planCacheRead", "cleanupStructuredEncryptionData",
+					"compactStructuredEncryptionData", "convertToCapped", "createCollection",
+					"createIndex", "createSearchIndexes", "dropCollection", "dropIndex",
+					"dropSearchIndex", "insert", "remove", "renameCollectionSameDB",
+					"update", "updateSearchIndex",
+				},
+			},
+			{
+				Resource: automationconfig.Resource{
+					Cluster: true,
+				},
+				Actions: []string{"bypassDefaultMaxTimeMS"},
+			},
+		},
+		AuthenticationRestrictions: nil,
+	}
+}
+
 // OverrideToAutomationConfig turns an automation config override from the resource spec into an automation config
 // which can be used to merge.
 func OverrideToAutomationConfig(override mdbv1.AutomationConfigOverride) automationconfig.AutomationConfig {
@@ -773,9 +835,7 @@ func getMongodConfigModification(mdb mdbv1.MongoDBCommunity) automationconfig.Mo
 // into the configuration set up by the operator.
 func getMongodConfigSearchModification(search *searchv1.MongoDBSearch) automationconfig.Modification {
 	if search == nil {
-		return func(config *automationconfig.AutomationConfig) {
-			// do nothing
-		}
+		return automationconfig.NOOP()
 	}
 
 	searchConfigParameters := search_controller.GetMongodConfigParameters(search)
diff --git a/mongodb-community-operator/pkg/mongot/mongot_config.go b/mongodb-community-operator/pkg/mongot/mongot_config.go
index 80d4c1421..c8126b173 100644
--- a/mongodb-community-operator/pkg/mongot/mongot_config.go
+++ b/mongodb-community-operator/pkg/mongot/mongot_config.go
@@ -1,41 +1,82 @@
 package mongot
 
-type Config struct {
-	CommunityPrivatePreview CommunityPrivatePreview `json:"communityPrivatePreview"`
+type Modification func(*Config)
+
+func NOOP() Modification {
+	return func(config *Config) {}
 }
 
-// CommunityPrivatePreview structure reflects private preview configuration from mongot:
-// https://github.com/10gen/mongot/blob/060ec179af062ac2639678f4a613b8ab02c21597/src/main/java/com/xgen/mongot/config/provider/community/CommunityConfig.java#L100
-// Comments are from the default config file: https://github.com/10gen/mongot/blob/375379e56a580916695a2f53e12fd4a99aa24f0b/deploy/community-resources/config.default.yml#L1-L0
-type CommunityPrivatePreview struct {
-	// Socket (IPv4/6) address of the sync source mongod
-	MongodHostAndPort string `json:"mongodHostAndPort"`
+func Apply(modifications ...Modification) func(*Config) {
+	return func(config *Config) {
+		for _, mod := range modifications {
+			mod(config)
+		}
+	}
+}
 
-	// Socket (IPv4/6) address on which to listen for wire protocol connections
-	QueryServerAddress string `json:"queryServerAddress"`
+type Config struct {
+	SyncSource  ConfigSyncSource  `json:"syncSource"`
+	Storage     ConfigStorage     `json:"storage"`
+	Server      ConfigServer      `json:"server"`
+	Metrics     ConfigMetrics     `json:"metrics"`
+	HealthCheck ConfigHealthCheck `json:"healthCheck"`
+	Logging     ConfigLogging     `json:"logging"`
+}
 
-	// Keyfile used for mongod -> mongot authentication
-	KeyFilePath string `json:"keyFilePath"`
+type ConfigSyncSource struct {
+	ReplicaSet ConfigReplicaSet `json:"replicaSet"`
+}
+
+type ConfigReplicaSet struct {
+	HostAndPort    []string `json:"hostAndPort"`
+	Username       string   `json:"username"`
+	PasswordFile   string   `json:"passwordFile"`
+	TLS            *bool    `json:"tls,omitempty"`
+	ReadPreference *string  `json:"readPreference,omitempty"`
+	AuthSource     *string  `json:"authSource,omitempty"`
+}
 
-	// Filesystem path that all mongot data will be stored at
+type ConfigStorage struct {
 	DataPath string `json:"dataPath"`
+}
 
-	// Options for metrics
-	Metrics Metrics `json:"metrics,omitempty"`
+type ConfigServer struct {
+	Wireproto *ConfigWireproto `json:"wireproto,omitempty"`
+}
+
+type ConfigWireproto struct {
+	Address        string                `json:"address"`
+	Authentication *ConfigAuthentication `json:"authentication,omitempty"`
+	TLS            ConfigTLS             `json:"tls"`
+}
 
-	// Options for logging
-	Logging Logging `json:"logging,omitempty"`
+type ConfigAuthentication struct {
+	Mode    string `json:"mode"`
+	KeyFile string `json:"keyFile"`
 }
 
-type Metrics struct {
-	// Whether to enable the Prometheus metrics endpoint
-	Enabled bool `json:"enabled"`
+type ConfigTLSMode string
+
+const (
+	ConfigTLSModeTLS      ConfigTLSMode = "TLS"
+	ConfigTLSModeDisabled ConfigTLSMode = "Disabled"
+)
+
+type ConfigTLS struct {
+	Mode               ConfigTLSMode `json:"mode"`
+	CertificateKeyFile *string       `json:"certificateKeyFile,omitempty"`
+}
+
+type ConfigMetrics struct {
+	Enabled bool   `json:"enabled"`
+	Address string `json:"address"`
+}
 
-	// Socket address (IPv4/6) on which the Prometheus /metrics endpoint will be exposed
+type ConfigHealthCheck struct {
 	Address string `json:"address"`
 }
 
-type Logging struct {
-	// Log level
-	Verbosity string `json:"verbosity"`
+type ConfigLogging struct {
+	Verbosity string  `json:"verbosity"`
+	LogPath   *string `json:"logPath,omitempty"`
 }
diff --git a/mongodb-community-operator/pkg/tls/tls.go b/mongodb-community-operator/pkg/tls/tls.go
new file mode 100644
index 000000000..77c49ed2a
--- /dev/null
+++ b/mongodb-community-operator/pkg/tls/tls.go
@@ -0,0 +1,113 @@
+package tls
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/types"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/mongodb/mongodb-kubernetes/mongodb-community-operator/pkg/kube/secret"
+)
+
+const (
+	CAMountPath             = "/var/lib/tls/ca/"
+	OperatorSecretMountPath = "/var/lib/tls/server/" //nolint
+
+	tlsSecretCertName = "tls.crt"
+	tlsSecretKeyName  = "tls.key"
+	tlsSecretPemName  = "tls.pem"
+)
+
+type TLSConfigurableResource interface {
+	metav1.Object
+	TLSSecretNamespacedName() types.NamespacedName
+	TLSOperatorSecretNamespacedName() types.NamespacedName
+}
+
+// ensureTLSSecret will create or update the operator-managed Secret containing
+// the concatenated certificate and key from the user-provided Secret.
+// Returns the file name of the concatenated certificate and key
+func EnsureTLSSecret(ctx context.Context, getUpdateCreator secret.GetUpdateCreator, resource TLSConfigurableResource) (string, error) {
+	certKey, err := getPemOrConcatenatedCrtAndKey(ctx, getUpdateCreator, resource.TLSSecretNamespacedName())
+	if err != nil {
+		return "", err
+	}
+	// Calculate file name from certificate and key
+	fileName := OperatorSecretFileName(certKey)
+
+	operatorSecret := secret.Builder().
+		SetName(resource.TLSOperatorSecretNamespacedName().Name).
+		SetNamespace(resource.TLSOperatorSecretNamespacedName().Namespace).
+		SetField(fileName, certKey).
+		SetOwnerReferences(resource.GetOwnerReferences()).
+		Build()
+
+	return fileName, secret.CreateOrUpdate(ctx, getUpdateCreator, operatorSecret)
+}
+
+// getCertAndKey will fetch the certificate and key from the user-provided Secret.
+func getCertAndKey(ctx context.Context, getter secret.Getter, secretName types.NamespacedName) string {
+	cert, err := secret.ReadKey(ctx, getter, tlsSecretCertName, secretName)
+	if err != nil {
+		return ""
+	}
+
+	key, err := secret.ReadKey(ctx, getter, tlsSecretKeyName, secretName)
+	if err != nil {
+		return ""
+	}
+
+	return combineCertificateAndKey(cert, key)
+}
+
+// getPem will fetch the pem from the user-provided secret
+func getPem(ctx context.Context, getter secret.Getter, secretName types.NamespacedName) string {
+	pem, err := secret.ReadKey(ctx, getter, tlsSecretPemName, secretName)
+	if err != nil {
+		return ""
+	}
+	return pem
+}
+
+func combineCertificateAndKey(cert, key string) string {
+	trimmedCert := strings.TrimRight(cert, "\n")
+	trimmedKey := strings.TrimRight(key, "\n")
+	return fmt.Sprintf("%s\n%s", trimmedCert, trimmedKey)
+}
+
+// getPemOrConcatenatedCrtAndKey will get the final PEM to write to the secret.
+// This is either the tls.pem entry in the given secret, or the concatenation
+// of tls.crt and tls.key
+// It performs a basic validation on the entries.
+func getPemOrConcatenatedCrtAndKey(ctx context.Context, getter secret.Getter, secretName types.NamespacedName) (string, error) {
+	certKey := getCertAndKey(ctx, getter, secretName)
+	pem := getPem(ctx, getter, secretName)
+	if certKey == "" && pem == "" {
+		return "", fmt.Errorf(`neither "%s" nor the pair "%s"/"%s" were present in the TLS secret`, tlsSecretPemName, tlsSecretCertName, tlsSecretKeyName)
+	}
+	if certKey == "" {
+		return pem, nil
+	}
+	if pem == "" {
+		return certKey, nil
+	}
+	if certKey != pem {
+		return "", fmt.Errorf(`if all of "%s", "%s" and "%s" are present in the secret, the entry for "%s" must be equal to the concatenation of "%s" with "%s"`, tlsSecretCertName, tlsSecretKeyName, tlsSecretPemName, tlsSecretPemName, tlsSecretCertName, tlsSecretKeyName)
+	}
+	return certKey, nil
+}
+
+// OperatorSecretFileName calculates the file name to use for the mounted
+// certificate-key file. The name is based on the hash of the combined cert and key.
+// If the certificate or key changes, the file path changes as well which will trigger
+// the agent to perform a restart.
+// The user-provided secret is being watched and will trigger a reconciliation
+// on changes. This enables the operator to automatically handle cert rotations.
+func OperatorSecretFileName(certKey string) string {
+	hash := sha256.Sum256([]byte(certKey))
+	return fmt.Sprintf("%x.pem", hash)
+}
diff --git a/public/crds.yaml b/public/crds.yaml
index ca69e1e33..f1683dd5f 100644
--- a/public/crds.yaml
+++ b/public/crds.yaml
@@ -4179,6 +4179,37 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
                     type: object
                 type: object
+              security:
+                properties:
+                  tls:
+                    properties:
+                      certificateKeySecretRef:
+                        description: |-
+                          CertificateKeySecret is a reference to a Secret containing a private key and certificate to use for TLS.
+                          The key and cert are expected to be PEM encoded and available at "tls.key" and "tls.crt".
+                          This is the same format used for the standard "kubernetes.io/tls" Secret type, but no specific type is required.
+                          Alternatively, an entry tls.pem, containing the concatenation of cert and key, can be provided.
+                          If all of tls.pem, tls.crt and tls.key are present, the tls.pem one needs to be equal to the concatenation of tls.crt and tls.key
+                        properties:
+                          name:
+                            default: ""
+                            description: |-
+                              Name of the referent.
+                              This field is effectively required, but due to backwards compatibility is
+                              allowed to be empty. Instances of this type with an empty value here are
+                              almost certainly wrong.
+                              TODO: Add other useful fields. apiVersion, kind, uid?
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              TODO: Drop `kubebuilder:default` when controller-gen doesn't need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                      enabled:
+                        type: boolean
+                    required:
+                    - enabled
+                    type: object
+                type: object
               source:
                 properties:
                   mongodbResourceRef:
@@ -4190,6 +4221,21 @@ spec:
                     required:
                     - name
                     type: object
+                  passwordSecretRef:
+                    description: |-
+                      SecretKeyRef is a reference to a value in a given secret in the same
+                      namespace. Based on:
+                      https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#secretkeyselector-v1-core
+                    properties:
+                      key:
+                        type: string
+                      name:
+                        type: string
+                    required:
+                    - name
+                    type: object
+                  username:
+                    type: string
                 type: object
               statefulSet:
                 description: |-
diff --git a/public/mongodb-kubernetes-multi-cluster.yaml b/public/mongodb-kubernetes-multi-cluster.yaml
index f53630a0e..b0372a6fd 100644
--- a/public/mongodb-kubernetes-multi-cluster.yaml
+++ b/public/mongodb-kubernetes-multi-cluster.yaml
@@ -432,9 +432,9 @@ spec:
               value: "ubi8"
             # Community Env Vars End
             - name: MDB_SEARCH_COMMUNITY_REPO_URL
-              value: "quay.io/mongodb"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com"
             - name: MDB_SEARCH_COMMUNITY_NAME
-              value: "mongodb-search-community"
+              value: "mongot/community"
             - name: MDB_SEARCH_COMMUNITY_VERSION
               value: "1.47.0"
       volumes:
diff --git a/public/mongodb-kubernetes-openshift.yaml b/public/mongodb-kubernetes-openshift.yaml
index 52bec8aca..402e65e5f 100644
--- a/public/mongodb-kubernetes-openshift.yaml
+++ b/public/mongodb-kubernetes-openshift.yaml
@@ -696,10 +696,10 @@ spec:
             - name: RELATED_IMAGE_MONGODB_IMAGE_8_0_0_ubi9
               value: "quay.io/mongodb/mongodb-enterprise-server:8.0.0-ubi9"
             - name: RELATED_IMAGE_MDB_SEARCH_IMAGE_1_47_0
-              value: "quay.io/mongodb/mongodb-search-community:1.47.0"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com/mongot/community:1.47.0"
             - name: MDB_SEARCH_COMMUNITY_REPO_URL
-              value: "quay.io/mongodb"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com"
             - name: MDB_SEARCH_COMMUNITY_NAME
-              value: "mongodb-search-community"
+              value: "mongot/community"
             - name: MDB_SEARCH_COMMUNITY_VERSION
               value: "1.47.0"
diff --git a/public/mongodb-kubernetes.yaml b/public/mongodb-kubernetes.yaml
index 69ff3f0e8..2875cdd81 100644
--- a/public/mongodb-kubernetes.yaml
+++ b/public/mongodb-kubernetes.yaml
@@ -428,8 +428,8 @@ spec:
               value: "ubi8"
             # Community Env Vars End
             - name: MDB_SEARCH_COMMUNITY_REPO_URL
-              value: "quay.io/mongodb"
+              value: "268558157000.dkr.ecr.eu-west-1.amazonaws.com"
             - name: MDB_SEARCH_COMMUNITY_NAME
-              value: "mongodb-search-community"
+              value: "mongot/community"
             - name: MDB_SEARCH_COMMUNITY_VERSION
               value: "1.47.0"
diff --git a/scripts/code_snippets/task_kind_community_search_snippets_test.sh b/scripts/code_snippets/task_kind_community_search_snippets_test.sh
index 4b4501c2c..4f23a3e37 100755
--- a/scripts/code_snippets/task_kind_community_search_snippets_test.sh
+++ b/scripts/code_snippets/task_kind_community_search_snippets_test.sh
@@ -5,7 +5,9 @@ source scripts/dev/set_env_context.sh
 
 dump_logs() {
   source scripts/evergreen/e2e/dump_diagnostic_information.sh
-  dump_all_non_default_namespaces "$@"
+  if [[ "${SKIP_DUMP:-"false"}" != "true" ]]; then
+    dump_all_non_default_namespaces "$@"
+  fi
 }
 trap dump_logs EXIT
 
diff --git a/scripts/dev/contexts/e2e_mdb_community b/scripts/dev/contexts/e2e_mdb_community
index 4f096c2d7..bc2f0f7f0 100644
--- a/scripts/dev/contexts/e2e_mdb_community
+++ b/scripts/dev/contexts/e2e_mdb_community
@@ -10,3 +10,12 @@ source "${script_dir}/variables/mongodb_latest"
 
 # This variable is needed otherwise the `fetch_om_information.sh` script is called and fails the test
 export OM_EXTERNALLY_CONFIGURED="true"
+
+# Temporary development images built from mongot master
+#export MDB_SEARCH_COMMUNITY_VERSION="776d43523d185b6b234289e17c191712a3e6569b" # master
+#export MDB_SEARCH_COMMUNITY_VERSION="d6884ae132aab30497af55dbaff05e8274e9775f" # Local->Admin
+#export MDB_SEARCH_COMMUNITY_VERSION="ad8acf5c3a045d6e0306ad67d61fcb5be40f57ae" # hardcoded mdbc-rs replicaset name
+#export MDB_SEARCH_COMMUNITY_VERSION="b9b80915f5571bfa5fc2aa70acb20d784e68d79b" # hardcoded Local->Admin, handled replicaSetName in config
+export MDB_SEARCH_COMMUNITY_VERSION="fbd60fb055dd500058edcb45677ea85d19421f47" # Nolan's fixes
+export MDB_SEARCH_COMMUNITY_NAME="mongot/community"
+export MDB_SEARCH_COMMUNITY_REPO_URL="268558157000.dkr.ecr.eu-west-1.amazonaws.com"
diff --git a/scripts/dev/contexts/private_kind_code_snippets b/scripts/dev/contexts/private_kind_code_snippets
index 704957a6f..970f0dc3f 100644
--- a/scripts/dev/contexts/private_kind_code_snippets
+++ b/scripts/dev/contexts/private_kind_code_snippets
@@ -8,6 +8,7 @@ script_name=$(readlink -f "${BASH_SOURCE[0]}")
 script_dir=$(dirname "${script_name}")
 
 source "${script_dir}/root-context"
+source "${script_dir}/e2e_mdb_community"
 
 export NAMESPACE=mongodb
 export CODE_SNIPPETS_FLAVOR=e2e_private
diff --git a/scripts/dev/contexts/root-context b/scripts/dev/contexts/root-context
index 7b147aa34..ddae31401 100644
--- a/scripts/dev/contexts/root-context
+++ b/scripts/dev/contexts/root-context
@@ -6,10 +6,12 @@ script_name=$(readlink -f "${BASH_SOURCE[0]}")
 script_dir=$(dirname "${script_name}")
 source "${script_dir}/private-context"
 
-export PROJECT_DIR="${PWD}"
+PROJECT_DIR="$(realpath "${script_dir}/../../..")"
+export PROJECT_DIR
 export IMAGE_TYPE=ubi
 export UBI_IMAGE_WITHOUT_SUFFIX=true
 export WATCH_NAMESPACE=${WATCH_NAMESPACE:-${NAMESPACE}}
+export OPERATOR_NAME="mongodb-kubernetes-operator"
 
 #
 # changing variables below should not be necessary
@@ -35,7 +37,7 @@ fi
 
 export OPERATOR_ENV=${OPERATOR_ENV:-"dev"}
 
-AGENT_VERSION="$(jq -r '.agentVersion' release.json)"
+AGENT_VERSION="$(jq -r '.agentVersion' "${PROJECT_DIR}/release.json")"
 export AGENT_VERSION
 export AGENT_IMAGE="${MDB_AGENT_IMAGE_REPOSITORY}:${AGENT_VERSION}"
 
@@ -111,7 +113,7 @@ export MDB_COMMUNITY_REPO_URL=quay.io/mongodb
 export MDB_COMMUNITY_AGENT_IMAGE=${AGENT_IMAGE}
 export MDB_COMMUNITY_IMAGE_TYPE=ubi8
 
-MDB_SEARCH_COMMUNITY_VERSION="$(jq -r '.search.community.version' release.json)"
+MDB_SEARCH_COMMUNITY_VERSION="$(jq -r '.search.community.version' "${PROJECT_DIR}/release.json")"
 export MDB_SEARCH_COMMUNITY_VERSION
 
 export MDB_SEARCH_COMMUNITY_NAME="mongodb-search-community"
diff --git a/scripts/dev/update_docs_snippets.sh b/scripts/dev/update_docs_snippets.sh
index b9a45b378..bdec61db2 100755
--- a/scripts/dev/update_docs_snippets.sh
+++ b/scripts/dev/update_docs_snippets.sh
@@ -46,17 +46,16 @@ function prepare_repositories() {
 }
 
 function copy_files() {
-  samples_dir=$1
-  dst_dir="${DOCS_DIR}/source/includes/code-examples/reference-architectures/${samples_dir}"
-  src_dir="${MCK_DIR}/public/architectures/${samples_dir}"
+  local src_dir="$1"
+  local dst_dir="$2"
 
   rm -rf "${dst_dir}"
   mkdir -p "${dst_dir}"
 
-  cp -r "${src_dir}/code_snippets" "${dst_dir}"
-  cp -r "${src_dir}/output" "${dst_dir}" || true
-  cp "${src_dir}/env_variables.sh" "${dst_dir}" || true
-  cp -r "${src_dir}/yamls" "${dst_dir}" || true
+  cp -r "${src_dir}/code_snippets" "${dst_dir}" 2>/dev/null || true
+  cp -r "${src_dir}/output" "${dst_dir}" 2>/dev/null || true
+  cp "${src_dir}/env_variables.sh" "${dst_dir}" 2>/dev/null || true
+  cp -r "${src_dir}/yamls" "${dst_dir}" 2>/dev/null || true
 }
 
 function prepare_docs_pr() {
@@ -74,17 +73,26 @@ function prepare_docs_pr() {
 
 pushd ../
 prepare_repositories
-copy_files "ops-manager-multi-cluster"
-copy_files "ops-manager-mc-no-mesh"
-copy_files "mongodb-sharded-multi-cluster"
-copy_files "mongodb-sharded-mc-no-mesh"
-copy_files "mongodb-replicaset-multi-cluster"
-copy_files "mongodb-replicaset-mc-no-mesh"
-copy_files "setup-multi-cluster/verify-connectivity"
-copy_files "setup-multi-cluster/setup-gke"
-copy_files "setup-multi-cluster/setup-istio"
-copy_files "setup-multi-cluster/setup-operator"
-copy_files "setup-multi-cluster/setup-cert-manager"
-copy_files "setup-multi-cluster/setup-externaldns"
+
+REF_ARCH_SRC_DIR="${MCK_DIR}/public/architectures"
+REF_ARCH_DST_DIR="${DOCS_DIR}/source/includes/code-examples/reference-architectures"
+
+copy_files "${REF_ARCH_SRC_DIR}/ops-manager-multi-cluster" "${REF_ARCH_DST_DIR}/ops-manager-multi-cluster"
+copy_files "${REF_ARCH_SRC_DIR}/ops-manager-mc-no-mesh" "${REF_ARCH_DST_DIR}/ops-manager-mc-no-mesh"
+copy_files "${REF_ARCH_SRC_DIR}/mongodb-sharded-multi-cluster" "${REF_ARCH_DST_DIR}/mongodb-sharded-multi-cluster"
+copy_files "${REF_ARCH_SRC_DIR}/mongodb-sharded-mc-no-mesh" "${REF_ARCH_DST_DIR}/mongodb-sharded-mc-no-mesh"
+copy_files "${REF_ARCH_SRC_DIR}/mongodb-replicaset-multi-cluster" "${REF_ARCH_DST_DIR}/mongodb-replicaset-multi-cluster"
+copy_files "${REF_ARCH_SRC_DIR}/mongodb-replicaset-mc-no-mesh" "${REF_ARCH_DST_DIR}/mongodb-replicaset-mc-no-mesh"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/verify-connectivity" "${REF_ARCH_DST_DIR}/setup-multi-cluster/verify-connectivity"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/setup-gke" "${REF_ARCH_DST_DIR}/setup-multi-cluster/setup-gke"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/setup-istio" "${REF_ARCH_DST_DIR}/setup-multi-cluster/setup-istio"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/setup-operator" "${REF_ARCH_DST_DIR}/setup-multi-cluster/setup-operator"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/setup-cert-manager" "${REF_ARCH_DST_DIR}/setup-multi-cluster/setup-cert-manager"
+copy_files "${REF_ARCH_SRC_DIR}/setup-multi-cluster/setup-externaldns" "${REF_ARCH_DST_DIR}/setup-multi-cluster/setup-externaldns"
+
+DOCS_SNIPPETS_SRC_DIR="${MCK_DIR}/docs"
+DOCS_SNIPPEES_DST_DIR="${DOCS_DIR}/source/includes/code-examples"
+copy_files "${DOCS_SNIPPETS_SRC_DIR}/community-search/quick-start" "${DOCS_SNIPPEES_DST_DIR}/community-search/quick-start"
+
 prepare_docs_pr
 popd
diff --git a/scripts/funcs/operator_deployment b/scripts/funcs/operator_deployment
index 36c1f4764..55f690546 100644
--- a/scripts/funcs/operator_deployment
+++ b/scripts/funcs/operator_deployment
@@ -34,6 +34,9 @@ get_operator_helm_values() {
     "operator.telemetry.send.enabled=${MDB_OPERATOR_TELEMETRY_SEND_ENABLED:-false}"
     # lets collect and save in the configmap as frequently as we can
     "operator.telemetry.collection.frequency=${MDB_OPERATOR_TELEMETRY_COLLECTION_FREQUENCY:-1m}"
+    "search.community.repo=${MDB_SEARCH_COMMUNITY_REPO_URL}"
+    "search.community.name=${MDB_SEARCH_COMMUNITY_NAME}"
+    "search.community.version=${MDB_SEARCH_COMMUNITY_VERSION}"
   )
 
   if [[ "${MDB_OPERATOR_TELEMETRY_INSTALL_CLUSTER_ROLE_INSTALLATION:-}" != "" ]]; then
