Skip to content

Commit 18e23d3

Browse files
lsierantlsierant
committed
Merge remote-tracking branch 'origin/master' into search/public-preview
2 parents ea3eeba + 588fcb5 commit 18e23d3

23 files changed

+1012
-813
lines changed

‎.evergreen-periodic-builds.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,22 @@ tasks:
103103
vars:
104104
image_name: mongodb-agent-1-daily
105105

106+
- name: periodic_build_agent_2
107+
exec_timeout_secs: 43200
108+
commands:
109+
- func: enable_QEMU
110+
- func: pipeline
111+
vars:
112+
image_name: mongodb-agent-2-daily
113+
114+
- name: periodic_build_agent_3
115+
exec_timeout_secs: 43200
116+
commands:
117+
- func: enable_QEMU
118+
- func: pipeline
119+
vars:
120+
image_name: mongodb-agent-3-daily
121+
106122
#TODO should we still build the community operator?
107123
- name: periodic_build_community_operator
108124
commands:
@@ -142,6 +158,8 @@ task_groups:
142158
- periodic_build_sbom_cli
143159
- periodic_build_agent
144160
- periodic_build_agent_1
161+
- periodic_build_agent_2
162+
- periodic_build_agent_3
145163

146164
- name: periodic_teardown_task_group
147165
<<: *setup_group

‎.githooks/pre-commit‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,11 @@ function generate_standalone_yaml() {
3333
mkdir -p "${charttmpdir}"
3434

3535
FILES=(
36-
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles.yaml"
36+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml"
37+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml"
38+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml"
39+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml"
40+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-webhook.yaml"
3741
"${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml"
3842
"${charttmpdir}/mongodb-kubernetes/templates/operator-sa.yaml"
3943
"${charttmpdir}/mongodb-kubernetes/templates/operator.yaml"
@@ -45,22 +49,25 @@ function generate_standalone_yaml() {
4549
cat "helm_chart/crds/"* >public/crds.yaml
4650

4751
# generate openshift public example
48-
rm -rf "${charttmpdir:?}/*"
52+
rm -rf "${charttmpdir:?}"/*
4953
helm template --namespace mongodb -f helm_chart/values.yaml helm_chart --output-dir "${charttmpdir}" --values helm_chart/values-openshift.yaml ${HELM_OPTS[@]}
5054
cat "${FILES[@]}" >public/mongodb-kubernetes-openshift.yaml
5155

5256
# generate openshift files for kustomize used for generating OLM bundle
53-
rm -rf "${charttmpdir:?}/*"
57+
rm -rf "${charttmpdir:?}"/*
5458
helm template --namespace mongodb -f helm_chart/values.yaml helm_chart --output-dir "${charttmpdir}" --values helm_chart/values-openshift.yaml \
5559
--set operator.webhook.registerConfiguration=false --set operator.webhook.installClusterRole=false ${HELM_OPTS[@]}
5660

5761
# update kustomize files for OLM bundle with files generated for openshift
5862
cp "${charttmpdir}/mongodb-kubernetes/templates/operator.yaml" config/manager/manager.yaml
5963
cp "${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml" config/rbac/database-roles.yaml
60-
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles.yaml" config/rbac/operator-roles.yaml
64+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml" config/rbac/operator-roles-base.yaml
65+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml" config/rbac/operator-roles-clustermongodbroles.yaml
66+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml" config/rbac/operator-roles-pvc-resize.yaml
67+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml" config/rbac/operator-roles-telemetry.yaml
6168

6269
# generate multi-cluster public example
63-
rm -rf "${charttmpdir:?}/*"
70+
rm -rf "${charttmpdir:?}"/*
6471
helm template --namespace mongodb -f helm_chart/values.yaml helm_chart --output-dir "${charttmpdir}" --values helm_chart/values-multi-cluster.yaml ${HELM_OPTS[@]}
6572
cat "${FILES[@]}" >public/mongodb-kubernetes-multi-cluster.yaml
6673

‎RELEASE_NOTES.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,15 @@
11
[//]: # (Consider renaming or removing the header for next release, otherwise it appears as duplicate in the published release, e.g: https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.22.0 )
22
<!-- Next Release -->
33

4+
# MCK 1.3.0 Release Notes
5+
6+
## Other Changes
7+
* Optional permissions for `PersistentVolumeClaim` moved to a separate role. When managing the operator with Helm it is possible to disable permissions for `PersistentVolumeClaim` resources by setting `operator.enablePVCResize` value to `false` (`true` by default). When enabled, previously these permissions were part of the primary operator role. With this change, permissions have a separate role.
8+
* `subresourceEnabled` Helm value was removed. This setting used to be `true` by default and made it possible to exclude subresource permissions from the operator role by specifying `false` as the value. We are removing this configuration option, making the operator roles always have subresource permissions. This setting was introduced as a temporary solution for [this](https://bugzilla.redhat.com/show_bug.cgi?id=1803171) OpenShift issue. The issue has since been resolved and the setting is no longer needed.
9+
10+
11+
<!-- Past Releases -->
12+
413
# MCK 1.2.0 Release Notes
514

615
## New Features
@@ -28,7 +37,6 @@
2837
## Bug Fixes
2938
* Fixed an issue where moving a **MongoDBMultiCluster** resource to a new project (or a new OM instance) would leave the deployment in a failed state.
3039

31-
<!-- Past Releases -->
3240

3341
# MCK 1.1.0 Release Notes
3442

‎changelog/20250715_other_split_persistentvolumeclaims_rbac_into_a_separate.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: Permissions for PersistentVolumeClaim moved to a separate role
3+
kind: other
4+
date: 2025-07-15
5+
---
6+
7+
* Optional permissions for `PersistentVolumeClaim` moved to a separate role. When managing the operator with Helm it is possible to disable permissions for `PersistentVolumeClaim` resources by setting `operator.enablePVCResize` value to `false` (`true` by default). When enabled, previously these permissions were part of the primary operator role. With this change, permissions have a separate role.

‎changelog/20250715_other_subresourceenabled_helm_value_removed.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: subresourceEnabled Helm value was removed
3+
kind: other
4+
date: 2025-07-15
5+
---
6+
7+
* `subresourceEnabled` Helm value was removed. This setting used to be `true` by default and made it possible to exclude subresource permissions from the operator role by specifying `false` as the value. We are removing this configuration option, making the operator roles always have subresource permissions. This setting was introduced as a temporary solution for [this](https://bugzilla.redhat.com/show_bug.cgi?id=1803171) OpenShift issue. The issue has since been resolved and the setting is no longer needed.

‎config/rbac/kustomization.yaml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ kind: Kustomization
33

44
resources:
55
- database-roles.yaml
6-
- operator-roles.yaml
6+
- operator-roles-base.yaml
7+
- operator-roles-clustermongodbroles.yaml
8+
- operator-roles-pvc-resize.yaml
9+
- operator-roles-telemetry.yaml
710

811
# we have to remove service account namespace from RoleBinding as OLM is not overriding it
912
patchesJson6902:
@@ -13,4 +16,3 @@ patchesJson6902:
1316
kind: RoleBinding
1417
name: mongodb-kubernetes-appdb
1518
path: database-roles-patch-namespace.yaml
16-

‎config/rbac/operator-roles-base.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
3+
kind: Role
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator
7+
namespace: mongodb
8+
rules:
9+
- apiGroups:
10+
- ''
11+
resources:
12+
- services
13+
verbs:
14+
- get
15+
- list
16+
- watch
17+
- create
18+
- update
19+
- delete
20+
- apiGroups:
21+
- ''
22+
resources:
23+
- secrets
24+
- configmaps
25+
verbs:
26+
- get
27+
- list
28+
- create
29+
- update
30+
- delete
31+
- watch
32+
- apiGroups:
33+
- apps
34+
resources:
35+
- statefulsets
36+
verbs:
37+
- create
38+
- get
39+
- list
40+
- watch
41+
- delete
42+
- update
43+
- apiGroups:
44+
- ''
45+
resources:
46+
- pods
47+
verbs:
48+
- get
49+
- list
50+
- watch
51+
- delete
52+
- deletecollection
53+
- apiGroups:
54+
- mongodbcommunity.mongodb.com
55+
resources:
56+
- mongodbcommunity
57+
- mongodbcommunity/status
58+
- mongodbcommunity/spec
59+
- mongodbcommunity/finalizers
60+
verbs:
61+
- '*'
62+
- apiGroups:
63+
- mongodb.com
64+
verbs:
65+
- '*'
66+
resources:
67+
- mongodb
68+
- mongodb/finalizers
69+
- mongodbusers
70+
- mongodbusers/finalizers
71+
- opsmanagers
72+
- opsmanagers/finalizers
73+
- mongodbmulticluster
74+
- mongodbmulticluster/finalizers
75+
- mongodbsearch
76+
- mongodbsearch/finalizers
77+
- mongodb/status
78+
- mongodbusers/status
79+
- opsmanagers/status
80+
- mongodbmulticluster/status
81+
- mongodbsearch/status
82+
---
83+
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
84+
kind: RoleBinding
85+
apiVersion: rbac.authorization.k8s.io/v1
86+
metadata:
87+
name: mongodb-kubernetes-operator
88+
namespace: mongodb
89+
roleRef:
90+
apiGroup: rbac.authorization.k8s.io
91+
kind: Role
92+
name: mongodb-kubernetes-operator
93+
subjects:
94+
- kind: ServiceAccount
95+
name: mongodb-kubernetes-operator
96+
namespace: mongodb

‎config/rbac/operator-roles-clustermongodbroles.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
---
15+
# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
16+
kind: ClusterRoleBinding
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
metadata:
19+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
20+
roleRef:
21+
apiGroup: rbac.authorization.k8s.io
22+
kind: ClusterRole
23+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
24+
subjects:
25+
- kind: ServiceAccount
26+
name: mongodb-kubernetes-operator
27+
namespace: mongodb

‎config/rbac/operator-roles-pvc-resize.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
3+
kind: Role
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-pvc-resize
7+
namespace: mongodb
8+
rules:
9+
- apiGroups:
10+
- ''
11+
resources:
12+
- persistentvolumeclaims
13+
verbs:
14+
- get
15+
- delete
16+
- list
17+
- watch
18+
- patch
19+
- update
20+
---
21+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
22+
kind: RoleBinding
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
metadata:
25+
name: mongodb-kubernetes-operator-pvc-resize-binding
26+
namespace: mongodb
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: Role
30+
name: mongodb-kubernetes-operator-pvc-resize
31+
subjects:
32+
- kind: ServiceAccount
33+
name: mongodb-kubernetes-operator
34+
namespace: mongodb

‎config/rbac/operator-roles-telemetry.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
3+
# Additional ClusterRole for clusterVersionDetection
4+
kind: ClusterRole
5+
apiVersion: rbac.authorization.k8s.io/v1
6+
metadata:
7+
name: mongodb-kubernetes-operator-cluster-telemetry
8+
rules:
9+
# Non-resource URL permissions
10+
- nonResourceURLs:
11+
- "/version"
12+
verbs:
13+
- get
14+
# Cluster-scoped resource permissions
15+
- apiGroups:
16+
- ''
17+
resources:
18+
- namespaces
19+
resourceNames:
20+
- kube-system
21+
verbs:
22+
- get
23+
- apiGroups:
24+
- ''
25+
resources:
26+
- nodes
27+
verbs:
28+
- list
29+
---
30+
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
31+
# ClusterRoleBinding for clusterVersionDetection
32+
kind: ClusterRoleBinding
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
metadata:
35+
name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
36+
roleRef:
37+
apiGroup: rbac.authorization.k8s.io
38+
kind: ClusterRole
39+
name: mongodb-kubernetes-operator-cluster-telemetry
40+
subjects:
41+
- kind: ServiceAccount
42+
name: mongodb-kubernetes-operator
43+
namespace: mongodb

0 commit comments

Comments
 (0)