Skip to content
This repository was archived by the owner on Dec 12, 2025. It is now read-only.

Commit 49184ac

Browse files
alyacbalyacb
authored
Refactor custom roles in crd (#293)
* Refactor Roles from Spec.Security.Authentication to Spec.Security * Add missing crd field * Fix yaml whitespace
1 parent 75bfad8 commit 49184ac

File tree

6 files changed

+108
-110
lines changed

6 files changed

+108
-110
lines changed

‎deploy/crds/mongodb.com_mongodb_crd.yaml‎

Lines changed: 85 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -75,96 +75,95 @@ spec:
7575
- SCRAM
7676
type: string
7777
type: array
78-
roles:
79-
description: User-specified custom MongoDB roles that should
80-
be configured in the deployment.
81-
items:
82-
description: CustomRole defines a custom MongoDB role.
83-
properties:
84-
authenticationRestrictions:
85-
description: The authentication restrictions the server
86-
enforces on the role.
87-
items:
88-
description: AuthenticationRestriction specifies a list
89-
of IP addresses and CIDR ranges users are allowed
90-
to connect to or from.
91-
properties:
92-
clientSource:
93-
items:
94-
type: string
95-
type: array
96-
serverAddress:
97-
items:
98-
type: string
99-
type: array
100-
required:
101-
- clientSource
102-
- serverAddress
103-
type: object
104-
type: array
105-
db:
106-
description: The database of the role.
107-
type: string
108-
privileges:
109-
description: The privileges to grant the role.
110-
items:
111-
description: Privilege defines the actions a role is
112-
allowed to perform on a given resource.
113-
properties:
114-
actions:
115-
items:
116-
type: string
117-
type: array
118-
resource:
119-
description: Resource specifies specifies the resources
120-
upon which a privilege permits actions. See https://docs.mongodb.com/manual/reference/resource-document
121-
for more.
122-
properties:
123-
anyResource:
124-
type: boolean
125-
cluster:
126-
type: boolean
127-
collection:
128-
type: string
129-
db:
130-
type: string
131-
type: object
132-
required:
133-
- actions
134-
- resource
135-
type: object
136-
type: array
137-
role:
138-
description: The name of the role.
139-
type: string
140-
roles:
141-
description: An array of roles from which this role inherits
142-
privileges.
143-
items:
144-
description: Role is the database role this user should
145-
have
78+
required:
79+
- modes
80+
type: object
81+
roles:
82+
description: User-specified custom MongoDB roles that should be
83+
configured in the deployment.
84+
items:
85+
description: CustomRole defines a custom MongoDB role.
86+
properties:
87+
authenticationRestrictions:
88+
description: The authentication restrictions the server enforces
89+
on the role.
90+
items:
91+
description: AuthenticationRestriction specifies a list
92+
of IP addresses and CIDR ranges users are allowed to connect
93+
to or from.
94+
properties:
95+
clientSource:
96+
items:
97+
type: string
98+
type: array
99+
serverAddress:
100+
items:
101+
type: string
102+
type: array
103+
required:
104+
- clientSource
105+
- serverAddress
106+
type: object
107+
type: array
108+
db:
109+
description: The database of the role.
110+
type: string
111+
privileges:
112+
description: The privileges to grant the role.
113+
items:
114+
description: Privilege defines the actions a role is allowed
115+
to perform on a given resource.
116+
properties:
117+
actions:
118+
items:
119+
type: string
120+
type: array
121+
resource:
122+
description: Resource specifies specifies the resources
123+
upon which a privilege permits actions. See https://docs.mongodb.com/manual/reference/resource-document
124+
for more.
146125
properties:
147-
db:
148-
description: DB is the database the role can act
149-
on
126+
anyResource:
127+
type: boolean
128+
cluster:
129+
type: boolean
130+
collection:
150131
type: string
151-
name:
152-
description: Name is the name of the role
132+
db:
153133
type: string
154-
required:
155-
- db
156-
- name
157134
type: object
158-
type: array
159-
required:
160-
- db
161-
- privileges
162-
- role
163-
type: object
164-
type: array
165-
required:
166-
- modes
167-
type: object
135+
required:
136+
- actions
137+
- resource
138+
type: object
139+
type: array
140+
role:
141+
description: The name of the role.
142+
type: string
143+
roles:
144+
description: An array of roles from which this role inherits
145+
privileges.
146+
items:
147+
description: Role is the database role this user should
148+
have
149+
properties:
150+
db:
151+
description: DB is the database the role can act on
152+
type: string
153+
name:
154+
description: Name is the name of the role
155+
type: string
156+
required:
157+
- db
158+
- name
159+
type: object
160+
type: array
161+
required:
162+
- db
163+
- privileges
164+
- role
165+
type: object
166+
type: array
168167
tls:
169168
description: TLS configuration for both client-server and server-server
170169
communication

‎deploy/crds/mongodb.com_v1_mongodb_custom_role.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,16 +10,16 @@ spec:
1010
security:
1111
authentication:
1212
modes: ["SCRAM"]
13-
roles: # custom roles are defined here
14-
- role: testRole
15-
db: admin
16-
privileges:
17-
- resource:
18-
db: "test"
19-
collection: "" # an empty string indicates any collection
20-
actions:
21-
- find
22-
roles: []
13+
roles: # custom roles are defined here
14+
- role: testRole
15+
db: admin
16+
privileges:
17+
- resource:
18+
db: "test"
19+
collection: "" # an empty string indicates any collection
20+
actions:
21+
- find
22+
roles: []
2323
users:
2424
- name: my-user
2525
db: admin

‎pkg/apis/mongodb/v1/mongodb_types.go‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,9 @@ type Security struct {
273273
// TLS configuration for both client-server and server-server communication
274274
// +optional
275275
TLS TLS `json:"tls"`
276+
// User-specified custom MongoDB roles that should be configured in the deployment.
277+
// +optional
278+
Roles []CustomRole `json:"roles,omitempty"`
276279
}
277280

278281
// TLS is the configuration used to set up TLS encryption
@@ -306,10 +309,6 @@ type LocalObjectReference struct {
306309
type Authentication struct {
307310
// Modes is an array specifying which authentication methods should be enabled
308311
Modes []AuthMode `json:"modes"`
309-
310-
// User-specified custom MongoDB roles that should be configured in the deployment.
311-
// +optional
312-
Roles []CustomRole `json:"roles,omitempty"`
313312
}
314313

315314
// +kubebuilder:validation:Enum=SCRAM

‎pkg/apis/mongodb/v1/zz_generated.deepcopy.go‎

Lines changed: 7 additions & 7 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/controller/mongodb/replica_set_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -552,7 +552,7 @@ func (r ReplicaSetReconciler) validateUpdate(mdb mdbv1.MongoDB) error {
552552
}
553553

554554
func getCustomRolesModification(mdb mdbv1.MongoDB) (automationconfig.Modification, error) {
555-
roles := mdb.Spec.Security.Authentication.Roles
555+
roles := mdb.Spec.Security.Roles
556556
if roles == nil {
557557
return automationconfig.NOOP(), nil
558558
}

‎test/e2e/replica_set_custom_role/replica_set_custom_role_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func TestReplicaSetCustomRole(t *testing.T) {
2929
anyCollection := ""
3030

3131
mdb, user := e2eutil.NewTestMongoDB("mdb0", "")
32-
mdb.Spec.Security.Authentication.Roles = []mdbv1.CustomRole{
32+
mdb.Spec.Security.Roles = []mdbv1.CustomRole{
3333
{
3434
Role: "testRole",
3535
DB: "admin",
@@ -87,7 +87,7 @@ func TestReplicaSetCustomRole(t *testing.T) {
8787
t.Run("AutomationConfig has the correct version", mongodbtests.AutomationConfigVersionHasTheExpectedVersion(&mdb, 1))
8888

8989
// Verify automation config roles and roles created in admin database.
90-
roles := mdbv1.ConvertCustomRolesToAutomationConfigCustomRole(mdb.Spec.Security.Authentication.Roles)
90+
roles := mdbv1.ConvertCustomRolesToAutomationConfigCustomRole(mdb.Spec.Security.Roles)
9191
t.Run("AutomationConfig has the correct custom role", mongodbtests.AutomationConfigHasTheExpectedCustomRoles(&mdb, roles))
9292
t.Run("Custom Role was created ", tester.VerifyRoles(roles, 1))
9393

0 commit comments

Comments
 (0)