Skip to content

CLOUDP-322487 - Change webhook's CR and CRB resource names to include operator name and namespace #393

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

CLOUDP-322487 - Change webhook's CR and CRB resource names to include operator name and namespace #393

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
be2afb0
add unit test
nammn Sep 1, 2025
dcc2ec2
add unit test
nammn Sep 1, 2025
c51782a
add unit test
nammn Sep 1, 2025
b13fdd0
add explicit cr and crb
nammn Sep 2, 2025
d7ec9ba
Merge branch 'master' into webhook-clusterrole
nammn Sep 2, 2025
26431a5
add explicit cr and crb
nammn Sep 2, 2025
033d782
Merge branch 'webhook-clusterrole' of github.com:mongodb/mongodb-kube…
nammn Sep 2, 2025
6a322f3
remove comment
nammn Sep 2, 2025
75cdd52
add changelog
nammn Sep 2, 2025
96c2679
Update changelog/20250902_fix_helm_chart_webhook_per_namespace.md
nammn Sep 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions .evergreen-functions.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -727,6 +727,16 @@ functions:
params:
files: [ "src/github.com/mongodb/mongodb-kubernetes/*.suite", "src/github.com/mongodb/mongodb-kubernetes/docker/mongodb-kubernetes-init-ops-manager/mmsconfiguration/*.suite" ]

test_helm_unit:
- command: shell.exec
type: test
params:
shell: bash
working_dir: src/github.com/mongodb/mongodb-kubernetes
script: |
source .generated/context.export.env
make helm-tests

test_python_unit:
- command: shell.exec
type: test
Expand Down
6 changes: 6 additions & 0 deletions .evergreen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,6 +275,11 @@ tasks:
commands:
- func: "test_python_unit"

- name: unit_tests_helm
tags: [ "unit_tests" ]
commands:
- func: "test_helm_unit"

- name: sbom_tests
tags: [ "unit_tests" ]
# The SBOM tests run only on commit builds. Running this on patches might cause false-positive failures
Expand Down Expand Up @@ -665,6 +670,7 @@ task_groups:
- lint_repo
- unit_tests_golang
- unit_tests_python
- unit_tests_helm
- sbom_tests

- name: gke_code_snippets_task_group
Expand Down
13 changes: 11 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -300,8 +300,17 @@ test-race: generate fmt vet manifests golang-tests-race

test: generate fmt vet manifests golang-tests

# all-tests will run golang and python tests without race (used locally)
all-tests: test python-tests
# helm-tests will run helm chart unit tests
helm-tests: ## Run helm chart unit tests
@echo "Running helm chart unit tests..."
@if ! helm plugin list | grep -q unittest; then \
echo "Installing helm-unittest plugin..."; \
helm plugin install https://github.com/helm-unittest/helm-unittest; \
fi
helm unittest helm_chart --color

# all-tests will run golang, python, and helm tests without race (used locally)
all-tests: test python-tests helm-tests

# Build manager binary
manager: generate fmt vet
Expand Down
10 changes: 5 additions & 5 deletions helm_chart/templates/operator-roles-webhook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@

{{/* This cluster role and binding is necessary to allow the operator to automatically register ValidatingWebhookConfiguration. */}}
{{- if and .Values.operator.webhook.registerConfiguration .Values.operator.webhook.installClusterRole }}
{{- if not (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "mongodb-kubernetes-operator-mongodb-webhook") }}
{{- $webhookClusterRoleName := printf "%s-%s-webhook-cr" .Values.operator.name (include "mongodb-kubernetes-operator.namespace" .) }}
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i've changed both names, because one was dynamic and one not - causing upgrade problems. Now both are just a new set of names.

{{- $webhookClusterRoleBindingName := printf "%s-%s-webhook-crb" .Values.operator.name (include "mongodb-kubernetes-operator.namespace" .) }}
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{.Values.operator.baseName}}-operator-mongodb-webhook
name: {{ $webhookClusterRoleName }}
rules:
- apiGroups:
- "admissionregistration.k8s.io"
Expand All @@ -28,17 +29,16 @@ rules:
- create
- update
- delete
{{- end }}
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ .Values.operator.name }}-{{ include "mongodb-kubernetes-operator.namespace" . }}-webhook-binding
name: {{ $webhookClusterRoleBindingName }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{.Values.operator.baseName}}-operator-mongodb-webhook
name: {{ $webhookClusterRoleName }}
subjects:
- kind: ServiceAccount
name: {{ .Values.operator.name }}
Expand Down
52 changes: 52 additions & 0 deletions helm_chart/tests/webhook_clusterrole_test.yaml
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

does this test verify that subsequent upgrades of the chart does not break the rbac?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no - we only have e2e tests that verify latest (1.2.0) -> current (code build) and those are passing.

We don't have current -> current, but I don't see how this could be failing, do you think we should test this in particular?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally we should have a test in our CI that upgrades the released helm chart version to the current local version to test things.

Copy link
Collaborator Author

@nammn nammn Sep 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we only have e2e tests that verify latest (1.2.0) -> current (code build) and those are passing.

isn't that exactly that - or are we talking about different things?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its operator_upgrade_ops_manager we have suite of those

mongodb-kubernetes/docker/mongodb-kubernetes-tests/tests/upgrades/operator_upgrade_ops_manager.py

Line 148 in f29ac63

operator = get_default_operator(

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if thats the case then what @lucian-tosa said, is already covered right?

Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
suite: test webhook consistent clusterrole and binding
templates:
- operator-roles-webhook.yaml
tests:
- it: should have consistent ClusterRole and ClusterRoleBinding names
set:
operator.webhook.registerConfiguration: true
operator.webhook.installClusterRole: true
asserts:
- hasDocuments:
count: 2
- isKind:
of: ClusterRole
documentIndex: 0
- isKind:
of: ClusterRoleBinding
documentIndex: 1
- equal:
path: metadata.name
value: mongodb-kubernetes-operator-NAMESPACE-webhook-cr
documentIndex: 0
- equal:
path: metadata.name
value: mongodb-kubernetes-operator-NAMESPACE-webhook-crb
documentIndex: 1
- equal:
path: roleRef.name
value: mongodb-kubernetes-operator-NAMESPACE-webhook-cr
documentIndex: 1

# Test that different installations get unique names (prevents conflicts)
- it: should create unique names per installation
set:
operator.name: my-operator
operator.namespace: custom-ns
operator.webhook.registerConfiguration: true
operator.webhook.installClusterRole: true
release:
namespace: custom-ns
asserts:
- equal:
path: metadata.name
value: my-operator-custom-ns-webhook-cr
documentIndex: 0
- equal:
path: metadata.name
value: my-operator-custom-ns-webhook-crb
documentIndex: 1
- equal:
path: roleRef.name
value: my-operator-custom-ns-webhook-cr
documentIndex: 1
6 changes: 3 additions & 3 deletions public/mongodb-kubernetes-multi-cluster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@ subjects:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-multi-cluster-mongodb-webhook-cr
rules:
- apiGroups:
- "admissionregistration.k8s.io"
Expand All @@ -230,11 +230,11 @@ rules:
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-multi-cluster-mongodb-webhook-binding
name: mongodb-kubernetes-operator-multi-cluster-mongodb-webhook-crb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-multi-cluster-mongodb-webhook-cr
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator-multi-cluster
Expand Down
6 changes: 3 additions & 3 deletions public/mongodb-kubernetes-openshift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@ subjects:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-mongodb-webhook-cr
rules:
- apiGroups:
- "admissionregistration.k8s.io"
Expand All @@ -230,11 +230,11 @@ rules:
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-mongodb-webhook-binding
name: mongodb-kubernetes-operator-mongodb-webhook-crb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-mongodb-webhook-cr
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator
Expand Down
6 changes: 3 additions & 3 deletions public/mongodb-kubernetes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@ subjects:
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-mongodb-webhook-cr
rules:
- apiGroups:
- "admissionregistration.k8s.io"
Expand All @@ -230,11 +230,11 @@ rules:
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: mongodb-kubernetes-operator-mongodb-webhook-binding
name: mongodb-kubernetes-operator-mongodb-webhook-crb
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: mongodb-kubernetes-operator-mongodb-webhook
name: mongodb-kubernetes-operator-mongodb-webhook-cr
subjects:
- kind: ServiceAccount
name: mongodb-kubernetes-operator
Expand Down