Fix telemetry RBAC template

[m1kola]

Summary

Currently ClusterRoleBinding is still being rendered when telemetry.enabled is true, but telemetry.installClusterRole is false.

Proof of Work

Comparing results fo the following template renderings.

1. Telemetry enabled, telemetry RBAC enabled.

   helm template --show-only \
     templates/operator-roles.yaml \
     ./helm_chart \
     --namespace mongodb \
     --set operator.telemetry.enabled=true \
     --set operator.telemetry.installClusterRole=true \
     | yq 'select((.kind == "ClusterRoleBinding" or .kind == "ClusterRole") and (.metadata.name | contains("telemetry")))'

2. Telemetry enabled, telemetry RBAC disabled

   helm template --show-only \
     templates/operator-roles.yaml \
     ./helm_chart \
     --namespace mongodb \
     --set operator.telemetry.enabled=true \
     --set operator.telemetry.installClusterRole=false \
     | yq 'select((.kind == "ClusterRoleBinding" or .kind == "ClusterRole") and (.metadata.name | contains("telemetry")))'

Before

1. Telemetry enabled, telemetry RBAC enabled.

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   # Additional ClusterRole for clusterVersionDetection
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-cluster-telemetry
   rules:
     # Non-resource URL permissions
     - nonResourceURLs:
         - "/version"
       verbs:
         - get
     # Cluster-scoped resource permissions
     - apiGroups:
         - ''
       resources:
         - namespaces
       resourceNames:
         - kube-system
       verbs:
         - get
     - apiGroups:
         - ''
       resources:
         - nodes
       verbs:
         - list
   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   # ClusterRoleBinding for clusterVersionDetection
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-cluster-telemetry
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

2. Telemetry enabled, telemetry RBAC disabled

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   # ClusterRoleBinding for clusterVersionDetection
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-cluster-telemetry
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

After

1. Telemetry enabled, telemetry RBAC enabled.

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   # Additional ClusterRole for clusterVersionDetection
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-cluster-telemetry
   rules:
     # Non-resource URL permissions
     - nonResourceURLs:
         - "/version"
       verbs:
         - get
     # Cluster-scoped resource permissions
     - apiGroups:
         - ''
       resources:
         - namespaces
       resourceNames:
         - kube-system
       verbs:
         - get
     - apiGroups:
         - ''
       resources:
         - nodes
       verbs:
         - list
   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   # ClusterRoleBinding for clusterVersionDetection
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-cluster-telemetry-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-cluster-telemetry
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

2. Telemetry enabled, telemetry RBAC disabled

   # (Nothing)

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you checked for release_note changes?

Reminder (Please remove this when merging)

• Please try to Approve or Reject Changes the PR, keep PRs in review as short as possible
• Our Short Guide for PRs: Link
• Remember the following Communication Standards - use comment prefixes for clarity:
  • blocking: Must be addressed before approval.
  • follow-up: Can be addressed in a later PR or ticket.
  • q: Clarifying question.
  • nit: Non-blocking suggestions.
  • note: Side-note, non-actionable. Example: Praise
  • --> no prefix is considered a question

[mircea-cosbuc]

Nice catch! LGTM

[m1kola]

I think I might've misdiagnosed it. Telemetry rendering for some reason (in master) depends on operator.webhook.registerConfiguration...

Putting this back to draft for further investigation.

[m1kola]

There is an issue with rendering when operator.webhook.registerConfiguration is set to false, but it is not relevant. I'll submit a separate PR for that.

Added proof of work to the PR description.

[m1kola]

Rebased on top of master to include changes from #254.

[m1kola]

Another rebase on top of master to include #255.

This keeps perma failing e2e_sharded_cluster_x509_to_scram_transition and I'm not sure how this is relevant to telemetry RBAC at the moment. Might require further investigation.

[m1kola]

I looked into e2e_sharded_cluster_x509_to_scram_transition and it looks like failure is not related: STS does not report ready on time in test_can_enable_scram_sha_256. I see the same failures in other PRs. It seems like e2e_static_mdb_kind_ubi_cloudqa is more flaky than non-static variant.