Fix YAML document separator in operator RBAC

[m1kola]

Summary

Helm doesn't render webhook ClusterRole if clustermongodbroles RBAC is not rendered due to operator.enableClusterMongoDBRoles being set to false.

Proof of Work

Testing with the following commands:

1. clustermongodbroles RBAC is disabled.

   helm template --show-only \
         templates/operator-roles.yaml \
         ./helm_chart \
         --namespace mongodb \
         --set operator.enableClusterMongoDBRoles=false \
         | yq 'select((.kind == "ClusterRoleBinding" or .kind == "ClusterRole") and (.metadata.name | contains("webhook")))'

2. clustermongodbroles RBAC is enabled.

   helm template --show-only \
         templates/operator-roles.yaml \
         ./helm_chart \
         --namespace mongodb \
         --set operator.enableClusterMongoDBRoles=true \
         | yq 'select((.kind == "ClusterRoleBinding" or .kind == "ClusterRole") and (.metadata.name | contains("webhook")))'

Before

1. clustermongodbroles RBAC is disabled.

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-mongodb-webhook
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

2. clustermongodbroles RBAC is enabled.

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook
   rules:
     - apiGroups:
         - "admissionregistration.k8s.io"
       resources:
         - validatingwebhookconfigurations
       verbs:
         - get
         - create
         - update
         - delete
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - delete
   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-mongodb-webhook
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

After

1. clustermongodbroles RBAC is disabled.

   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook
   rules:
     - apiGroups:
         - "admissionregistration.k8s.io"
       resources:
         - validatingwebhookconfigurations
       verbs:
         - get
         - create
         - update
         - delete
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - delete
   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-mongodb-webhook
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

2. clustermongodbroles RBAC is enabled.

   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook
   rules:
     - apiGroups:
         - "admissionregistration.k8s.io"
       resources:
         - validatingwebhookconfigurations
       verbs:
         - get
         - create
         - update
         - delete
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - get
         - list
         - watch
         - create
         - update
         - delete
   ---
   # Source: mongodb-kubernetes/templates/operator-roles.yaml
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: mongodb-kubernetes-operator-mongodb-webhook-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: mongodb-kubernetes-operator-mongodb-webhook
   subjects:
     - kind: ServiceAccount
       name: mongodb-kubernetes-operator
       namespace: mongodb

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you checked for release_note changes?

Reminder (Please remove this when merging)

• Please try to Approve or Reject Changes the PR, keep PRs in review as short as possible
• Our Short Guide for PRs: Link
• Remember the following Communication Standards - use comment prefixes for clarity:
  • blocking: Must be addressed before approval.
  • follow-up: Can be addressed in a later PR or ticket.
  • q: Clarifying question.
  • nit: Non-blocking suggestions.
  • note: Side-note, non-actionable. Example: Praise
  • --> no prefix is considered a question