CLOUDP-400891: Remove installClusterRole Helm Value#1385
Conversation
josvazg
left a comment
There was a problem hiding this comment.
q: isn't this missing the changelog entry? it is a breaking change on its own AFAIU
| - name: e2e_operator_no_webhook_roles_cloudqa | ||
| display_name: e2e_operator_no_webhook_roles_cloudqa | ||
| tags: [ "pr_patch_e2e", "staging", "e2e_test_suite", "cloudqa", "cloudqa_non_static" ] | ||
| <<: *production_code_paths | ||
| run_on: | ||
| - ubuntu2404-large | ||
| <<: *base_no_om_image_dependency | ||
| tasks: | ||
| - name: e2e_mdb_kind_no_webhook_roles_cloudqa_task_group |
There was a problem hiding this comment.
Currently in master there are two things that gate webhook RBAC:
if and .Values.operator.webhook.registerConfiguration .Values.operator.webhook.installClusterRole
We've decided that operator.webhook.installClusterRole is redundant, but operator.webhook.registerConfiguration still stays in place and still gates RBAC.
IMO we should keep testing that there is a way to not deploy webhook RBAC and keep the operator functional. So the question is: do we have another test that does the same, but using operator.webhook.registerConfiguration? If yes - then we can remove it. If no - then we should update the test to use operator.webhook.registerConfiguration instead of operator.webhook.installClusterRole.
P.S: I think it is an overkill to run a whole E2E test just to test this. IMO it should be covered by Helm chart tests and unit tests (that the operator can handle absent RBAC well). That's an alternative you can explore, but not worth spinning wheels on it too much. Making existing approach work is good enough.
Summary
Remove installClusterRole helm value, and also a test that checked if it worked (which is now useless because it doesn't exist anymore).
This functionality is now exclusively configured using
operator.webhook.registerConfigurationProof of Work
Checklist
skip-changeloglabel if not needed