fixes for the role of user admin

Author: gkech

pkg/controller/perconaservermongodb/mgo.go

@@ -647,7 +647,7 @@ func (r *ReconcilePerconaServerMongoDB) handleRsAddToShard(ctx context.Context,
 }
 
 // handleReplsetInit initializes the replset within the first running pod's mongod container.
-// This must be ran from within the running container to utilize the MongoDB Localhost Exception.
+// This must be run from within the running container to utilize the MongoDB Localhost Exception.
 //
 // See: https://www.mongodb.com/docs/manual/core/localhost-exception/
 func (r *ReconcilePerconaServerMongoDB) handleReplsetInit(ctx context.Context, cr *api.PerconaServerMongoDB, replset *api.ReplsetSpec, pods []corev1.Pod) (*corev1.Pod, *api.ReplsetMemberStatus, error) {
@@ -1007,6 +1007,7 @@ func (r *ReconcilePerconaServerMongoDB) createOrUpdateSystemUsers(ctx context.Co
 	}
 
 	users := []api.SystemUserRole{api.RoleClusterAdmin, api.RoleClusterMonitor, api.RoleBackup, api.RoleDatabaseAdmin}
+	// When handleReplsetInit is not executed, e.g. when auth is disabled, the UserAdmin role should be created.
 	if cr.CompareVersion("1.22.0") >= 0 {
 		users = append(users, api.RoleUserAdmin)
 	}
@@ -1029,7 +1030,7 @@ func (r *ReconcilePerconaServerMongoDB) createOrUpdateSystemUsers(ctx context.Co
 			}
 			continue
 		}
-		if !compareRoles(user.Roles, getRoles(cr, role)) {
+		if !compareRoles(user.Roles, getRoles(cr, role)) && role != api.RoleUserAdmin {
 			log.Info("Updating user roles", "database", "admin", "user", creds.Username, "currentRoles", user.Roles, "newRoles", getRoles(cr, role))
 			err = cli.UpdateUserRoles(ctx, "admin", creds.Username, getRoles(cr, role))
 			if err != nil {