Skip to content

CLOUDP-400891: Remove installClusterRole Helm Value#1385

Open
roothorp wants to merge 2 commits into
feature/mc-installation-uxfrom
cloudp-400891-remove-installclusterrole-helm
Open

CLOUDP-400891: Remove installClusterRole Helm Value#1385
roothorp wants to merge 2 commits into
feature/mc-installation-uxfrom
cloudp-400891-remove-installclusterrole-helm

Conversation

@roothorp

Copy link
Copy Markdown
Collaborator

Summary

Remove installClusterRole helm value, and also a test that checked if it worked (which is now useless because it doesn't exist anymore).

This functionality is now exclusively configured using operator.webhook.registerConfiguration

Proof of Work

Checklist

  • Have you linked a jira ticket and/or is the ticket in the title?
  • Have you checked whether your jira ticket required DOCSP changes?
  • Have you added changelog file?

@roothorp
roothorp requested a review from a team as a code owner July 16, 2026 09:18
@roothorp
roothorp requested review from Julien-Ben, anandsyncs, josvazg and m1kola and removed request for a team, Julien-Ben and anandsyncs July 16, 2026 09:18

@josvazg josvazg left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

q: isn't this missing the changelog entry? it is a breaking change on its own AFAIU

Comment thread .evergreen.yml
Comment on lines -1955 to -1963
- name: e2e_operator_no_webhook_roles_cloudqa
display_name: e2e_operator_no_webhook_roles_cloudqa
tags: [ "pr_patch_e2e", "staging", "e2e_test_suite", "cloudqa", "cloudqa_non_static" ]
<<: *production_code_paths
run_on:
- ubuntu2404-large
<<: *base_no_om_image_dependency
tasks:
- name: e2e_mdb_kind_no_webhook_roles_cloudqa_task_group

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Currently in master there are two things that gate webhook RBAC:

if and .Values.operator.webhook.registerConfiguration .Values.operator.webhook.installClusterRole

We've decided that operator.webhook.installClusterRole is redundant, but operator.webhook.registerConfiguration still stays in place and still gates RBAC.

IMO we should keep testing that there is a way to not deploy webhook RBAC and keep the operator functional. So the question is: do we have another test that does the same, but using operator.webhook.registerConfiguration? If yes - then we can remove it. If no - then we should update the test to use operator.webhook.registerConfiguration instead of operator.webhook.installClusterRole.

P.S: I think it is an overkill to run a whole E2E test just to test this. IMO it should be covered by Helm chart tests and unit tests (that the operator can handle absent RBAC well). That's an alternative you can explore, but not worth spinning wheels on it too much. Making existing approach work is good enough.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants