roles are not cleaned up by the operator

[KyriosGN0]

Report

when changing the name of the role from ab to dc/ab the old role remains in that database

More about the problem

when i do db.system.roles.find() i see both roles

Steps to reproduce

1. create role with name ab
2. change role name to db/ab
3. run db.system.roles.find() and observe they both exist

Versions

1. Kubernetes 1.33
2. Operator 1.21.1
3. Database mongo 7.0.26-14

Anything else?

No response

[egegunes]

Actually this is by design. We made a conscious decision to not delete any custom user/role from db when they're deleted from cr.yaml. Checked our documentation and looks like this behavior is not documented properly. Created K8SPSMDB-1543 to address this.

[DrFaust92]

egegunes can we consider adding it and opting in where default can be not to remove? this kind of breaks the whole gitops/infra as code at the very least and creates a security issue at its worst. imagine we have a leaked cred/user and we delete it only to realize its still there...

[egegunes]

imagine we have a leaked cred/user and we delete it only to realize its still there...

you raised a good point @DrFaust92, created K8SPSMDB-1544 to consider this feature.