-
Notifications
You must be signed in to change notification settings - Fork 14
CLOUDP-331496: Split operator roles into smaller templates #258
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
@@ -0,0 +1,145 @@ | |||
{{ if .Values.operator.createOperatorServiceAccount }} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is used to be operator-roles.yaml
. I moved telemetry, webhook and clustermongodbroles
RBAC into separate templates. Rest of the file is unchanged.
99eff6e
to
80f9488
Compare
80f9488
to
1ad4641
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Summary
It becomes increasingly difficult to maintain operator roles in a single template. We recently fixed a series of issues (1, 2, 3) caused by this complexity. We are also looking into unifying installation experience for single cluster & multi cluster setups - having all roles in single template makes it hard to comprehend and re-use in this context.
This PR splits existing roles into multiple template files without changes to the roles. Instead of single
operator-roles.yaml
there are now the following templates:operator-roles-base.yaml
- main role for the operator. Roles in this template will likely be split further into smaller roles. We can derive PVC resize Role and Role binding from it, for example.operator-roles-clustermongodbroles.yaml
- Role giving permissions toclustermongodbroles
resources.operator-roles-telemetry.yaml
- role defining permissions required for telemetry.operator-roles-webhook.yaml
- role defining permission for the operator to be able to register its own web hook.Proof of Work
No functional changes. CI must be green.
Checklist
Reminder (Please remove this when merging)