Skip to content

CLOUDP-331496: Remove undocumented operator.enablePVCResize Helm value #272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

CLOUDP-331496: Remove undocumented operator.enablePVCResize Helm value #272

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions .githooks/pre-commit
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ function generate_standalone_yaml() {
FILES=(
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml"
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml"
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml"
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml"
"${charttmpdir}/mongodb-kubernetes/templates/operator-roles-webhook.yaml"
"${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml"
Expand Down Expand Up @@ -63,7 +62,6 @@ function generate_standalone_yaml() {
cp "${charttmpdir}/mongodb-kubernetes/templates/database-roles.yaml" config/rbac/database-roles.yaml
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-base.yaml" config/rbac/operator-roles-base.yaml
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-clustermongodbroles.yaml" config/rbac/operator-roles-clustermongodbroles.yaml
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml" config/rbac/operator-roles-pvc-resize.yaml
cp "${charttmpdir}/mongodb-kubernetes/templates/operator-roles-telemetry.yaml" config/rbac/operator-roles-telemetry.yaml

# generate multi-cluster public example
Expand Down
2 changes: 1 addition & 1 deletion RELEASE_NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
# MCK 1.3.0 Release Notes

## Other Changes
* Optional permissions for `PersistentVolumeClaim` moved to a separate role. When managing the operator with Helm it is possible to disable permissions for `PersistentVolumeClaim` resources by setting `operator.enablePVCResize` value to `false` (`true` by default). When enabled, previously these permissions were part of the primary operator role. With this change, permissions have a separate role.
* The undocumented `operator.enablePVCResize` Helm value has been removed. If you previously set this value to `false`, please note that the operator roles will now include permissions for `PersistentVolumeClaim` resources by default.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be considered a breaking change, so requiring bumping major version...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Arguably it is not a breaking change since we are adding new RBAC by default. Yes, we are removing the setting which only appears in values.yaml, but at runtime it won't negatively affect the operator or workloads.

* `subresourceEnabled` Helm value was removed. This setting used to be `true` by default and made it possible to exclude subresource permissions from the operator role by specifying `false` as the value. We are removing this configuration option, making the operator roles always have subresource permissions. This setting was introduced as a temporary solution for [this](https://bugzilla.redhat.com/show_bug.cgi?id=1803171) OpenShift issue. The issue has since been resolved and the setting is no longer needed.


Expand Down
7 changes: 0 additions & 7 deletions changelog/20250715_other_split_persistentvolumeclaims_rbac_into_a_separate.md
View file
Open in desktop

This file was deleted.

7 changes: 7 additions & 0 deletions changelog/20250716_other_enablePVCResize_setting_removed.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
---
title: Undocumented operator.enablePVCResize Helm value has been removed
kind: other
date: 2025-07-15
---

* The undocumented `operator.enablePVCResize` Helm value has been removed. If you previously set this value to `false`, please note that the operator roles will now include permissions for `PersistentVolumeClaim` resources by default.
1 change: 0 additions & 1 deletion config/rbac/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ resources:
- database-roles.yaml
- operator-roles-base.yaml
- operator-roles-clustermongodbroles.yaml
- operator-roles-pvc-resize.yaml
- operator-roles-telemetry.yaml

# we have to remove service account namespace from RoleBinding as OLM is not overriding it
Expand Down
11 changes: 11 additions & 0 deletions config/rbac/operator-roles-base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,17 @@ rules:
- opsmanagers/status
- mongodbmulticluster/status
- mongodbsearch/status
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
kind: RoleBinding
Expand Down
34 changes: 0 additions & 34 deletions config/rbac/operator-roles-pvc-resize.yaml
View file
Open in desktop

This file was deleted.

11 changes: 11 additions & 0 deletions helm_chart/templates/operator-roles-base.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,17 @@ rules:
- opsmanagers/status
- mongodbmulticluster/status
- mongodbsearch/status
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
{{- if eq $roleScope "ClusterRole" }}
- apiGroups:
- ''
Expand Down
63 changes: 0 additions & 63 deletions helm_chart/templates/operator-roles-pvc-resize.yaml
View file
Open in desktop

This file was deleted.

3 changes: 0 additions & 3 deletions helm_chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,9 +71,6 @@ operator:
# Set to false to not create the ClusterRole and ClusterRoleBinding and to disable the operator watching the ClusterMongoDBRole resources.
enableClusterMongoDBRoles: true

# Set to false to not create the RBAC for enabling access to the PVC for resizing for the operator
enablePVCResize: true

vaultSecretBackend:
# set to true if you want the operator to store secrets in Vault
enabled: false
Expand Down
45 changes: 11 additions & 34 deletions public/mongodb-kubernetes-multi-cluster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,17 @@ rules:
- opsmanagers/status
- mongodbmulticluster/status
- mongodbsearch/status
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
kind: RoleBinding
Expand Down Expand Up @@ -122,40 +133,6 @@ subjects:
name: mongodb-kubernetes-operator-multi-cluster
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize
namespace: mongodb
rules:
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize-binding
namespace: mongodb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mongodb-kubernetes-operator-multi-cluster-pvc-resize
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator-multi-cluster
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
# Additional ClusterRole for clusterVersionDetection
kind: ClusterRole
Expand Down
45 changes: 11 additions & 34 deletions public/mongodb-kubernetes-openshift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,17 @@ rules:
- opsmanagers/status
- mongodbmulticluster/status
- mongodbsearch/status
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
kind: RoleBinding
Expand Down Expand Up @@ -122,40 +133,6 @@ subjects:
name: mongodb-kubernetes-operator
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-pvc-resize
namespace: mongodb
rules:
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-pvc-resize-binding
namespace: mongodb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mongodb-kubernetes-operator-pvc-resize
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
# Additional ClusterRole for clusterVersionDetection
kind: ClusterRole
Expand Down
45 changes: 11 additions & 34 deletions public/mongodb-kubernetes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,17 @@ rules:
- opsmanagers/status
- mongodbmulticluster/status
- mongodbsearch/status
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-base.yaml
kind: RoleBinding
Expand Down Expand Up @@ -122,40 +133,6 @@ subjects:
name: mongodb-kubernetes-operator
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-pvc-resize
namespace: mongodb
rules:
- apiGroups:
- ''
resources:
- persistentvolumeclaims
verbs:
- get
- delete
- list
- watch
- patch
- update
---
# Source: mongodb-kubernetes/templates/operator-roles-pvc-resize.yaml
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-pvc-resize-binding
namespace: mongodb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: mongodb-kubernetes-operator-pvc-resize
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator
namespace: mongodb
---
# Source: mongodb-kubernetes/templates/operator-roles-telemetry.yaml
# Additional ClusterRole for clusterVersionDetection
kind: ClusterRole
Expand Down
1 change: 0 additions & 1 deletion scripts/funcs/operator_deployment
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@ get_operator_helm_values() {
"mongodb.name=mongodb-enterprise-server"
"mongodb.imageType=${MDB_IMAGE_TYPE:-ubi8}"
"operator.mdbDefaultArchitecture=${MDB_DEFAULT_ARCHITECTURE:-non-static}"
"operator.enablePVCResize=${MDB_ENABLE_PVC_RESIZE:-true}"
# only send the telemetry to the backend on a specific variant, thus default to false
"operator.telemetry.send.enabled=${MDB_OPERATOR_TELEMETRY_SEND_ENABLED:-false}"
# lets collect and save in the configmap as frequently as we can
Expand Down