(DOCSSP-9092): Implement validation webhook for K8s Operator (#209)

* (DOCSSP-9092): Implement validation webhook for K8s Operator

* (DOCSP-9092): Tech review

* Update source/release-notes.txt

Co-Authored-By: Nick Larew <[email protected]>

* Fix release note

Co-authored-by: Nick Larew <[email protected]>

Author: 2 people

source/release-notes.txt

@@ -30,7 +30,8 @@ Release Notes for |k8s-op-full|
 |k8s-op-short| Changes
 ~~~~~~~~~~~~~~~~~~~~~~
 
-Added webhook to validate |k8s-op-short| configuration.
+Adds a :ref:`webhook <k8s-validation-webhook>` to validate
+a |k8s-op-short| configuration.
 
 MongoDB Resource Changes
 ~~~~~~~~~~~~~~~~~~~~~~~~

source/tutorial/plan-k8s-operator-install.txt

@@ -61,6 +61,33 @@ following operating systems:
 MongoDB, Inc. updates all packages on these images before releasing
 them every three weeks.
 
+.. _k8s-validation-webhook:
+
+Validation Webhook
+~~~~~~~~~~~~~~~~~~
+
+The |k8s-op-short| uses a webhook to prevent users from applying invalid
+resource definitions. The webhook rejects creating and updating replica
+sets in the following scenarios:
+
+- :setting:`spec.connectivity.replicaSetHorizons` is set, but
+  :setting:`spec.security.tls.enabled` is ``false`` or not set
+- :setting:`spec.connectivity.replicaSetHorizons` has a number of
+  horizons configured that is not equal to the number of members set in
+  :setting:`spec.members` 
+  
+The webhook rejects these requests immediately and the |k8s-op-short|
+doesn't create or update the resource.
+
+The ``ClusterRole`` and ``ClusterRoleBinding`` for the webhook are
+included in the default configuration files that you apply during
+installation. To create the role and binding, you must have
+:k8sdocs:`cluster-admin privileges
+</reference/access-authn-authz/rbac/#user-facing-roles>` . If you have
+insufficient privileges or if you choose to remove the role and binding
+from the default configuration, the |k8s-op-short| produces error logs
+and continues to function normally, but without validation rejections.
+
 .. _k8s-deployment-scopes:
 
 |k8s-op-short| Deployment Scopes