Skip to content

Commit a14dcb7

Browse files
m1kolam1kola
committed
Split operator roles into smaller templates
1 parent 69415eb commit a14dcb7

14 files changed

+694
-689
lines changed

‎.githooks/pre-commit

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,10 @@ function generate_standalone_yaml() {
3333
mkdir -p "${charttmpdir}"
3434

3535
FILES=(
36-
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles.yaml"
36+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml"
37+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml"
38+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml"
39+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-webhook.yaml"
3740
"${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml"
3841
"${charttmpdir}/mongodb-kubernetes/templates/operator-sa.yaml"
3942
"${charttmpdir}/mongodb-kubernetes/templates/operator.yaml"
@@ -57,7 +60,9 @@ function generate_standalone_yaml() {
5760
# update kustomize files for OLM bundle with files generated for openshift
5861
cp "${charttmpdir}/mongodb-kubernetes/templates/operator.yaml" config/manager/manager.yaml
5962
cp "${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml" config/rbac/database-roles.yaml
60-
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles.yaml" config/rbac/operator-roles.yaml
63+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml" config/rbac/operator-roles-base.yaml
64+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml" config/rbac/operator-roles-clustermongodbroles.yaml
65+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml" config/rbac/operator-roles-telemetry.yaml
6166

6267
# generate multi-cluster public example
6368
rm -rf "${charttmpdir:?}"/*

‎config/rbac/kustomization.yaml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,9 @@ kind: Kustomization
33

44
resources:
55
- database-roles.yaml
6-
- operator-roles.yaml
6+
- operator-roles-base.yaml
7+
- operator-roles-clustermongodbroles.yaml
8+
- operator-roles-telemetry.yaml
79

810
# we have to remove service account namespace from RoleBinding as OLM is not overriding it
911
patchesJson6902:
@@ -13,4 +15,3 @@ patchesJson6902:
1315
kind: RoleBinding
1416
name: mongodb-kubernetes-appdb
1517
path: database-roles-patch-namespace.yaml
16-

‎config/rbac/operator-roles.yaml renamed to ‎config/rbac/operator-roles-base.yaml

Lines changed: 2 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,5 @@
11
---
2-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
3-
kind: ClusterRole
4-
apiVersion: rbac.authorization.k8s.io/v1
5-
metadata:
6-
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7-
rules:
8-
- apiGroups:
9-
- mongodb.com
10-
verbs:
11-
- '*'
12-
resources:
13-
- clustermongodbroles
14-
---
15-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
16-
# Additional ClusterRole for clusterVersionDetection
17-
kind: ClusterRole
18-
apiVersion: rbac.authorization.k8s.io/v1
19-
metadata:
20-
name: mongodb-kubernetes-operator-cluster-telemetry
21-
rules:
22-
# Non-resource URL permissions
23-
- nonResourceURLs:
24-
- "/version"
25-
verbs:
26-
- get
27-
# Cluster-scoped resource permissions
28-
- apiGroups:
29-
- ''
30-
resources:
31-
- namespaces
32-
resourceNames:
33-
- kube-system
34-
verbs:
35-
- get
36-
- apiGroups:
37-
- ''
38-
resources:
39-
- nodes
40-
verbs:
41-
- list
42-
---
43-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
44-
kind: ClusterRoleBinding
45-
apiVersion: rbac.authorization.k8s.io/v1
46-
metadata:
47-
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
48-
roleRef:
49-
apiGroup: rbac.authorization.k8s.io
50-
kind: ClusterRole
51-
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
52-
subjects:
53-
- kind: ServiceAccount
54-
name: mongodb-kubernetes-operator
55-
namespace: mongodb
56-
---
57-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
58-
# ClusterRoleBinding for clusterVersionDetection
59-
kind: ClusterRoleBinding
60-
apiVersion: rbac.authorization.k8s.io/v1
61-
metadata:
62-
name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
63-
roleRef:
64-
apiGroup: rbac.authorization.k8s.io
65-
kind: ClusterRole
66-
name: mongodb-kubernetes-operator-cluster-telemetry
67-
subjects:
68-
- kind: ServiceAccount
69-
name: mongodb-kubernetes-operator
70-
namespace: mongodb
71-
---
72-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
2+
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
733
kind: Role
744
apiVersion: rbac.authorization.k8s.io/v1
755
metadata:
@@ -162,7 +92,7 @@ rules:
16292
- patch
16393
- update
16494
---
165-
# Source: mongodb-kubernetes/templates/operator-roles.yaml
95+
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
16696
kind: RoleBinding
16797
apiVersion: rbac.authorization.k8s.io/v1
16898
metadata:

‎config/rbac/operator-roles-clustermongodbroles.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
3+
kind: ClusterRole
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
7+
rules:
8+
- apiGroups:
9+
- mongodb.com
10+
verbs:
11+
- '*'
12+
resources:
13+
- clustermongodbroles
14+
---
15+
# Source: mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml
16+
kind: ClusterRoleBinding
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
metadata:
19+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role-binding
20+
roleRef:
21+
apiGroup: rbac.authorization.k8s.io
22+
kind: ClusterRole
23+
name: mongodb-kubernetes-operator-mongodb-cluster-mongodb-role
24+
subjects:
25+
- kind: ServiceAccount
26+
name: mongodb-kubernetes-operator
27+
namespace: mongodb

‎config/rbac/operator-roles-telemetry.yaml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
3+
# Additional ClusterRole for clusterVersionDetection
4+
kind: ClusterRole
5+
apiVersion: rbac.authorization.k8s.io/v1
6+
metadata:
7+
name: mongodb-kubernetes-operator-cluster-telemetry
8+
rules:
9+
# Non-resource URL permissions
10+
- nonResourceURLs:
11+
- "/version"
12+
verbs:
13+
- get
14+
# Cluster-scoped resource permissions
15+
- apiGroups:
16+
- ''
17+
resources:
18+
- namespaces
19+
resourceNames:
20+
- kube-system
21+
verbs:
22+
- get
23+
- apiGroups:
24+
- ''
25+
resources:
26+
- nodes
27+
verbs:
28+
- list
29+
---
30+
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
31+
# ClusterRoleBinding for clusterVersionDetection
32+
kind: ClusterRoleBinding
33+
apiVersion: rbac.authorization.k8s.io/v1
34+
metadata:
35+
name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
36+
roleRef:
37+
apiGroup: rbac.authorization.k8s.io
38+
kind: ClusterRole
39+
name: mongodb-kubernetes-operator-cluster-telemetry
40+
subjects:
41+
- kind: ServiceAccount
42+
name: mongodb-kubernetes-operator
43+
namespace: mongodb

‎helm_chart/templates/operator-roles-base.yaml

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
{{ if .Values.operator.createOperatorServiceAccount }}
2+
{{- $watchNamespace := include "mongodb-kubernetes-operator.namespace" . | list }}
3+
{{- if .Values.operator.watchNamespace }}
4+
{{- $watchNamespace = regexSplit "," .Values.operator.watchNamespace -1 }}
5+
{{- $watchNamespace = concat $watchNamespace (include "mongodb-kubernetes-operator.namespace" . | list) | uniq }}
6+
{{- end }}
7+
8+
{{- $roleScope := "Role" -}}
9+
{{- if or (gt (len $watchNamespace) 1) (eq (first $watchNamespace) "*") }}
10+
{{- $roleScope = "ClusterRole" }}
11+
{{- end }}
12+
---
13+
kind: {{ $roleScope }}
14+
apiVersion: rbac.authorization.k8s.io/v1
15+
metadata:
16+
name: {{ .Values.operator.name }}
17+
{{- if eq $roleScope "Role" }}
18+
namespace: {{ include "mongodb-kubernetes-operator.namespace" . }}
19+
{{- end }}
20+
rules:
21+
- apiGroups:
22+
- ''
23+
resources:
24+
- services
25+
verbs:
26+
- get
27+
- list
28+
- watch
29+
- create
30+
- update
31+
- delete
32+
- apiGroups:
33+
- ''
34+
resources:
35+
- secrets
36+
- configmaps
37+
verbs:
38+
- get
39+
- list
40+
- create
41+
- update
42+
- delete
43+
- watch
44+
- apiGroups:
45+
- apps
46+
resources:
47+
- statefulsets
48+
verbs:
49+
- create
50+
- get
51+
- list
52+
- watch
53+
- delete
54+
- update
55+
- apiGroups:
56+
- ''
57+
resources:
58+
- pods
59+
verbs:
60+
- get
61+
- list
62+
- watch
63+
- delete
64+
- deletecollection
65+
- apiGroups:
66+
- mongodbcommunity.mongodb.com
67+
resources:
68+
- mongodbcommunity
69+
- mongodbcommunity/status
70+
- mongodbcommunity/spec
71+
- mongodbcommunity/finalizers
72+
verbs:
73+
- '*'
74+
- apiGroups:
75+
- mongodb.com
76+
verbs:
77+
- '*'
78+
resources:
79+
- mongodb
80+
- mongodb/finalizers
81+
- mongodbusers
82+
- mongodbusers/finalizers
83+
- opsmanagers
84+
- opsmanagers/finalizers
85+
- mongodbmulticluster
86+
- mongodbmulticluster/finalizers
87+
- mongodbsearch
88+
- mongodbsearch/finalizers
89+
{{- if .Values.subresourceEnabled }}
90+
- mongodb/status
91+
- mongodbusers/status
92+
- opsmanagers/status
93+
- mongodbmulticluster/status
94+
- mongodbsearch/status
95+
{{- end }}
96+
{{- if eq $roleScope "ClusterRole" }}
97+
- apiGroups:
98+
- ''
99+
resources:
100+
- namespaces
101+
verbs:
102+
- list
103+
- watch
104+
{{- end}}
105+
{{ if .Values.operator.enablePVCResize }}
106+
- apiGroups:
107+
- ''
108+
resources:
109+
- persistentvolumeclaims
110+
verbs:
111+
- get
112+
- delete
113+
- list
114+
- watch
115+
- patch
116+
- update
117+
{{- end}}
118+
{{- range $idx, $namespace := $watchNamespace }}
119+
120+
{{- $namespaceBlock := "" }}
121+
{{- if not (eq $namespace "*") }}
122+
{{- $namespaceBlock = printf "namespace: %s" $namespace }}
123+
{{- end }}
124+
125+
---
126+
{{- if eq $namespace "*" }}
127+
kind: ClusterRoleBinding
128+
{{- else }}
129+
kind: RoleBinding
130+
{{- end }}
131+
apiVersion: rbac.authorization.k8s.io/v1
132+
metadata:
133+
name: {{ $.Values.operator.name }}
134+
{{ $namespaceBlock }}
135+
roleRef:
136+
apiGroup: rbac.authorization.k8s.io
137+
kind: {{ $roleScope }}
138+
name: {{ $.Values.operator.name }}
139+
subjects:
140+
- kind: ServiceAccount
141+
name: {{ $.Values.operator.name }}
142+
namespace: {{ include "mongodb-kubernetes-operator.namespace" $ }}
143+
{{- end }}
144+
145+
{{- end }}

‎helm_chart/templates/operator-roles-clustermongodbroles.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{ if .Values.operator.createOperatorServiceAccount }}
2+
{{- if .Values.operator.enableClusterMongoDBRoles }}
3+
---
4+
kind: ClusterRole
5+
apiVersion: rbac.authorization.k8s.io/v1
6+
metadata:
7+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role
8+
rules:
9+
- apiGroups:
10+
- mongodb.com
11+
verbs:
12+
- '*'
13+
resources:
14+
- clustermongodbroles
15+
---
16+
kind: ClusterRoleBinding
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
metadata:
19+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role-binding
20+
roleRef:
21+
apiGroup: rbac.authorization.k8s.io
22+
kind: ClusterRole
23+
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-cluster-mongodb-role
24+
subjects:
25+
- kind: ServiceAccount
26+
name: {{ .Values.operator.name }}
27+
namespace: {{ include "mongodb-kubernetes-operator.namespace" . }}
28+
29+
{{- end }}{{/* if .Values.operator.enableClusterMongoDBRoles */}}
30+
{{- end }}{{/* if .Values.operator.createOperatorServiceAccount */}}

0 commit comments

Comments
 (0)