CLOUDP-350197: allow to create a custom role with cluster: true

[lsierant]

Summary

This PR fixes a problem which was preventing creating cluster-wide mongodb custom roles.

Context
As described in MongoDB docs the resource object is either:

{ db: <database>, collection: <collection> }

or

{ cluster : true }

So that means we cannot provide empty strings for db and collection fields as empty string means "any db/collection".

At the same time our previous serialization rules were always sending empty strings even if not set. This was the source of the problem - it wasn't possible to specify cluster: true because the operator was also sending empty db and collections.

Backwards compatibility
Making db and collection fields just as omitempty *string is not sufficient, because that would change the semantics of the resource and would be potentially a breaking change. In order to preserve backwards compatibility we need additional logic (see normalizePrivilegeResource that will maintain the same behavior for non-cluster-wide resources (sending empty strings even if the field is not set in yaml).

Proof of Work

Tests passing.

Based on PR #551

Chain of upstream PRs as of 2025-10-25

• PR CLOUDP-349078: custom roles regression tests #551:
  master ← lsierant/custom-roles-regression-tests

  • PR CLOUDP-350197: allow to create a custom role with cluster: true #553 (THIS ONE):
    lsierant/custom-roles-regression-tests ← lsierant/custom-roles

[vinilage]

I propose to change to: "Fixed inability to specify cluster-wide privileges in custom roles."

[lsierant]

updated, thanks!

[vinilage]

LGMT!

[vinilage]

LGTM!

[mircea-cosbuc]

LGTM!

[github-actions]

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.6.0 Release Notes

New Features

• MongoDBCommunity: Added support to configure custom cluster domain via newly introduced spec.clusterDomain resource field. If spec.clusterDomain is not set, environment variable CLUSTER_DOMAIN is used as cluster domain. If the environment variable CLUSTER_DOMAIN is also not set, operator falls back to cluster.local as default cluster domain.
• Helm Chart: Introduced two new helm fields operator.podSecurityContext and operator.securityContext that can be used to configure securityContext for Operator deployment through Helm Chart.
• MongoDBSearch: Switch to gRPC and mTLS for internal communication
  Since MCK 1.4 the mongod and mongot processess communicated using the MongoDB Wire Protocol and used keyfile authentication. This release switches that to gRPC with mTLS authentication. gRPC will allow for load-balancing search queries against multiple mongot processes in the future, and mTLS decouples the internal cluster authentication mode and credentials among mongod processes from the connection to the mongot process. The Operator will automatically enable gRPC for existing and new workloads, and will enable mTLS authentication if both Database Server and MongoDBSearch resource are configured for TLS.
• MongoDBSearch: MongoDB deployments using X509 internal cluster authentication are now supported. Previously MongoDB Search required SCRAM authentication among members of a MongoDB replica set. Note: SCRAM client authentication is still required, this change merely relaxes the requirements on internal cluster authentication.
• MongoDBSearch: Updated the default mongodb/mongodb-search image version to 0.55.0. This is the version MCK uses if .spec.version is not specified.

Bug Fixes

• Fixed parsing of the customEnvVars Helm value when values contain = characters.
• ReplicaSet: Blocked disabling TLS and changing member count simultaneously. These operations must now be applied separately to prevent configuration inconsistencies.
• Fixed inability to specify cluster-wide privileges in custom roles.

Other Changes

• Simplified MongoDB Search setup: Removed the custom Search Coordinator polyfill (a piece of compatibility code previously needed to add the required permissions), as MongoDB 8.2.0 and later now include the necessary permissions via the built-in searchCoordinator role.
• kubectl-mongodb plugin: cosign, the signing tool that is used to sign kubectl-mongodb plugin binaries, has been updated to version 3.0.2. With this change, released binaries will be bundled with .bundle files containing both signature and certificate information. For more information on how to verify signatures using new cosign version please refer to -> https://github.com/sigstore/cosign/blob/v3.0.2/doc/cosign_verify-blob.md