CLOUDP-420747: Prepare CI to work on v# backport branches as well as master

[josvazg]

Summary

Ensure the CI keeps working the same on master than on future back-porting branches v1, v2, v3.

Proof of Work

TBD

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you added changelog file?
  • use skip-changelog label if not needed

[github-actions]

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.10.0 Release Notes

New Features

• MongoDBOpsManager, AppDB: The mongodb-agent-monitoring sidecar container has been merged into the main
  mongodb-agent container. Both automation and monitoring now run as a single process in a single container. The
  spec.appDB.monitoringAgent field is now deprecated and has no effect; Monitoring Agent options for the AppDB —
  including log level and rotation — are configured via spec.applicationDatabase.agent and
  spec.applicationDatabase.agent.monitoringAgent, the same fields used by MongoDB resources. Enabling AppDB
  monitoring still results in rolling restarts of AppDB pods.
• MongoDBSearch: Added support to show cluster level status of Search, Managed LoadBalancer and MetricsForwarder in the MongoDBSearch resource's status.clusters field.
• MongoDBSearch: Added support to configure the node affinity of the MongoDB Search (mongot) pods using the MongoDBSearch CR fields spec.clusters[].nodeAffinity or spec.clusters[].shardOverrides[].nodeAffinity.

Bug Fixes

• MongoDBUser: Fixed a bug where the connection string Secret created in the central cluster did not carry a controller owner reference to the MongoDBUser CR. The missing reference prevented Kubernetes garbage collection from cleaning up the Secret when the MongoDBUser was deleted.
• MongoDBUser: Fixed a bug where the ownership guard on the connection string Secret was always satisfied regardless of the actual owner, allowing the operator to silently overwrite a Secret controlled by a different resource.
• Fixed a bug where all MongoDBCommunity deployment telemetry rows incorrectly reported IsRunningEnterpriseImage = true. The field was being evaluated against the operator-level enterprise image rather than the image configured in each CR's spec, causing a misleading ~100% enterprise rate for the Community deployment type.
• IsRunningEnterpriseImage for Community deployments is now derived from the mongod container image override in spec.statefulSet.spec.template.spec.containers, if present. When no override is set, the field correctly defaults to false, reflecting that Community CRs use the community MongoDB server image by default.
• MongoDBOpsManager, AppDB: Fix for spec.applicationDatabase.agent.monitoringAgent.logRotate field not being
  handled properly. Additionally, added defaults for
  spec.applicationDatabase.agent.monitoringAgent.logRotate.sizeThresholdMB to 1000 and
  spec.applicationDatabase.agent.monitoringAgent.logRotate.timeThresholdHrs to 24, which are same defaults Ops Manager
  would set.
• MongoDBSearch: The default JVM heap size (half of the memory request) is now capped at 30GB, following the mongot sizing guidance. Heap sizes above ~30GB prevent the JVM from using compressed object pointers and degrade performance. User-provided heap flags are not affected, if more than 30GB heap is required, we recommend using jvmFlags.
• MongoDB: Fixed a bug where switching a MongoDB ReplicaSet or ShardedCluster to a new Ops Manager project could cause the automation agent to generate a random keyfile in the empty target project, breaking internal cluster authentication.

[semgrep-code-mongodb]

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

🧼 Fixed in commit 22f52dd 🧼