Skip to content

Commit 536c2dc

Browse files
m1kolam1kola
committed
Move PVC resize RBAC into a separate Role
1 parent 1bccada commit 536c2dc

9 files changed

+202
-61
lines changed

‎.githooks/pre-commit‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ function generate_standalone_yaml() {
3535
FILES=(
3636
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml"
3737
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml"
38+
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml"
3839
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml"
3940
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-webhook.yaml"
4041
"${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml"
@@ -62,6 +63,7 @@ function generate_standalone_yaml() {
6263
cp "${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml" config/rbac/database-roles.yaml
6364
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml" config/rbac/operator-roles-base.yaml
6465
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml" config/rbac/operator-roles-clustermongodbroles.yaml
66+
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml" config/rbac/operator-roles-pvc-resize.yaml
6567
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml" config/rbac/operator-roles-telemetry.yaml
6668

6769
# generate multi-cluster public example

‎config/rbac/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ resources:
55
- database-roles.yaml
66
- operator-roles-base.yaml
77
- operator-roles-clustermongodbroles.yaml
8+
- operator-roles-pvc-resize.yaml
89
- operator-roles-telemetry.yaml
910

1011
# we have to remove service account namespace from RoleBinding as OLM is not overriding it

‎config/rbac/operator-roles-base.yaml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -79,18 +79,6 @@ rules:
7979
- opsmanagers/status
8080
- mongodbmulticluster/status
8181
- mongodbsearch/status
82-
83-
- apiGroups:
84-
- ''
85-
resources:
86-
- persistentvolumeclaims
87-
verbs:
88-
- get
89-
- delete
90-
- list
91-
- watch
92-
- patch
93-
- update
9482
---
9583
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
9684
kind: RoleBinding

‎config/rbac/operator-roles-pvc-resize.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
---
2+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
3+
kind: Role
4+
apiVersion: rbac.authorization.k8s.io/v1
5+
metadata:
6+
name: mongodb-kubernetes-operator-pvc-resize
7+
namespace: mongodb
8+
rules:
9+
- apiGroups:
10+
- ''
11+
resources:
12+
- persistentvolumeclaims
13+
verbs:
14+
- get
15+
- delete
16+
- list
17+
- watch
18+
- patch
19+
- update
20+
---
21+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
22+
kind: RoleBinding
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
metadata:
25+
name: mongodb-kubernetes-operator-pvc-resize-binding
26+
namespace: mongodb
27+
roleRef:
28+
apiGroup: rbac.authorization.k8s.io
29+
kind: Role
30+
name: mongodb-kubernetes-operator-pvc-resize
31+
subjects:
32+
- kind: ServiceAccount
33+
name: mongodb-kubernetes-operator
34+
namespace: mongodb

‎helm_chart/templates/operator-roles-base.yaml‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -102,19 +102,6 @@ rules:
102102
- list
103103
- watch
104104
{{- end}}
105-
{{ if .Values.operator.enablePVCResize }}
106-
- apiGroups:
107-
- ''
108-
resources:
109-
- persistentvolumeclaims
110-
verbs:
111-
- get
112-
- delete
113-
- list
114-
- watch
115-
- patch
116-
- update
117-
{{- end}}
118105
{{- range $idx, $namespace := $watchNamespace }}
119106

120107
{{- $namespaceBlock := "" }}

‎helm_chart/templates/operator-roles-pvc-resize.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{{ if .Values.operator.createOperatorServiceAccount }}
2+
{{ if .Values.operator.enablePVCResize }}
3+
4+
{{- $watchNamespace := include "mongodb-kubernetes-operator.namespace" . | list }}
5+
{{- if .Values.operator.watchNamespace }}
6+
{{- $watchNamespace = regexSplit "," .Values.operator.watchNamespace -1 }}
7+
{{- $watchNamespace = concat $watchNamespace (include "mongodb-kubernetes-operator.namespace" . | list) | uniq }}
8+
{{- end }}
9+
10+
11+
{{- $roleScope := "Role" -}}
12+
{{- if or (gt (len $watchNamespace) 1) (eq (first $watchNamespace) "*") }}
13+
{{- $roleScope = "ClusterRole" }}
14+
{{- end }}
15+
---
16+
kind: {{ $roleScope }}
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
metadata:
19+
name: {{ .Values.operator.name }}-pvc-resize
20+
{{- if eq $roleScope "Role" }}
21+
namespace: {{ include "mongodb-kubernetes-operator.namespace" . }}
22+
{{- end }}
23+
rules:
24+
- apiGroups:
25+
- ''
26+
resources:
27+
- persistentvolumeclaims
28+
verbs:
29+
- get
30+
- delete
31+
- list
32+
- watch
33+
- patch
34+
- update
35+
{{- range $idx, $namespace := $watchNamespace }}
36+
37+
{{- $namespaceBlock := "" }}
38+
{{- if not (eq $namespace "*") }}
39+
{{- $namespaceBlock = printf "namespace: %s" $namespace }}
40+
{{- end }}
41+
42+
---
43+
{{- if eq $namespace "*" }}
44+
kind: ClusterRoleBinding
45+
{{- else }}
46+
kind: RoleBinding
47+
{{- end }}
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
metadata:
50+
name: {{ $.Values.operator.name }}-pvc-resize-binding
51+
{{ $namespaceBlock }}
52+
roleRef:
53+
apiGroup: rbac.authorization.k8s.io
54+
kind: {{ $roleScope }}
55+
name: {{ $.Values.operator.name }}-pvc-resize
56+
subjects:
57+
- kind: ServiceAccount
58+
name: {{ $.Values.operator.name }}
59+
namespace: {{ include "mongodb-kubernetes-operator.namespace" $ }}
60+
{{- end }}
61+
62+
{{- end}}{{/* if .Values.operator.enablePVCResize */}}
63+
{{- end}}{{/* if .Values.operator.createOperatorServiceAccount */}}

‎public/mongodb-kubernetes-multi-cluster.yaml‎

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -79,18 +79,6 @@ rules:
7979
- opsmanagers/status
8080
- mongodbmulticluster/status
8181
- mongodbsearch/status
82-
83-
- apiGroups:
84-
- ''
85-
resources:
86-
- persistentvolumeclaims
87-
verbs:
88-
- get
89-
- delete
90-
- list
91-
- watch
92-
- patch
93-
- update
9482
---
9583
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
9684
kind: RoleBinding
@@ -134,6 +122,40 @@ subjects:
134122
name: mongodb-kubernetes-operator-multi-cluster
135123
namespace: mongodb
136124
---
125+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
126+
kind: Role
127+
apiVersion: rbac.authorization.k8s.io/v1
128+
metadata:
129+
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize
130+
namespace: mongodb
131+
rules:
132+
- apiGroups:
133+
- ''
134+
resources:
135+
- persistentvolumeclaims
136+
verbs:
137+
- get
138+
- delete
139+
- list
140+
- watch
141+
- patch
142+
- update
143+
---
144+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
145+
kind: RoleBinding
146+
apiVersion: rbac.authorization.k8s.io/v1
147+
metadata:
148+
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize-binding
149+
namespace: mongodb
150+
roleRef:
151+
apiGroup: rbac.authorization.k8s.io
152+
kind: Role
153+
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize
154+
subjects:
155+
- kind: ServiceAccount
156+
name: mongodb-kubernetes-operator-multi-cluster
157+
namespace: mongodb
158+
---
137159
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
138160
# Additional ClusterRole for clusterVersionDetection
139161
kind: ClusterRole

‎public/mongodb-kubernetes-openshift.yaml‎

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -79,18 +79,6 @@ rules:
7979
- opsmanagers/status
8080
- mongodbmulticluster/status
8181
- mongodbsearch/status
82-
83-
- apiGroups:
84-
- ''
85-
resources:
86-
- persistentvolumeclaims
87-
verbs:
88-
- get
89-
- delete
90-
- list
91-
- watch
92-
- patch
93-
- update
9482
---
9583
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
9684
kind: RoleBinding
@@ -134,6 +122,40 @@ subjects:
134122
name: mongodb-kubernetes-operator
135123
namespace: mongodb
136124
---
125+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
126+
kind: Role
127+
apiVersion: rbac.authorization.k8s.io/v1
128+
metadata:
129+
name: mongodb-kubernetes-operator-pvc-resize
130+
namespace: mongodb
131+
rules:
132+
- apiGroups:
133+
- ''
134+
resources:
135+
- persistentvolumeclaims
136+
verbs:
137+
- get
138+
- delete
139+
- list
140+
- watch
141+
- patch
142+
- update
143+
---
144+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
145+
kind: RoleBinding
146+
apiVersion: rbac.authorization.k8s.io/v1
147+
metadata:
148+
name: mongodb-kubernetes-operator-pvc-resize-binding
149+
namespace: mongodb
150+
roleRef:
151+
apiGroup: rbac.authorization.k8s.io
152+
kind: Role
153+
name: mongodb-kubernetes-operator-pvc-resize
154+
subjects:
155+
- kind: ServiceAccount
156+
name: mongodb-kubernetes-operator
157+
namespace: mongodb
158+
---
137159
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
138160
# Additional ClusterRole for clusterVersionDetection
139161
kind: ClusterRole

‎public/mongodb-kubernetes.yaml‎

Lines changed: 34 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -79,18 +79,6 @@ rules:
7979
- opsmanagers/status
8080
- mongodbmulticluster/status
8181
- mongodbsearch/status
82-
83-
- apiGroups:
84-
- ''
85-
resources:
86-
- persistentvolumeclaims
87-
verbs:
88-
- get
89-
- delete
90-
- list
91-
- watch
92-
- patch
93-
- update
9482
---
9583
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
9684
kind: RoleBinding
@@ -134,6 +122,40 @@ subjects:
134122
name: mongodb-kubernetes-operator
135123
namespace: mongodb
136124
---
125+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
126+
kind: Role
127+
apiVersion: rbac.authorization.k8s.io/v1
128+
metadata:
129+
name: mongodb-kubernetes-operator-pvc-resize
130+
namespace: mongodb
131+
rules:
132+
- apiGroups:
133+
- ''
134+
resources:
135+
- persistentvolumeclaims
136+
verbs:
137+
- get
138+
- delete
139+
- list
140+
- watch
141+
- patch
142+
- update
143+
---
144+
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
145+
kind: RoleBinding
146+
apiVersion: rbac.authorization.k8s.io/v1
147+
metadata:
148+
name: mongodb-kubernetes-operator-pvc-resize-binding
149+
namespace: mongodb
150+
roleRef:
151+
apiGroup: rbac.authorization.k8s.io
152+
kind: Role
153+
name: mongodb-kubernetes-operator-pvc-resize
154+
subjects:
155+
- kind: ServiceAccount
156+
name: mongodb-kubernetes-operator
157+
namespace: mongodb
158+
---
137159
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
138160
# Additional ClusterRole for clusterVersionDetection
139161
kind: ClusterRole

0 commit comments

Comments
 (0)