Skip to content

Commit 92fa448

Browse files
JuliaMongojwilliams-mongo
JuliaMongo
authored and
jwilliams-mongo
committed
(DOCSP-18617) Watching multiple namespaces with the Operator (#751)
* (DOCSP-18617) Operator can watch a list of namespaces * (DOCSP-18617) Operator can watch a list of namespaces * Edits * Address copy review and tech review. Add includes to reuse examples in two topics * Fixing the build warnings * Fixing the build --one file was accidentally moved, moving it back * Fixing the build --one file was accidentally moved, moving it back * Add a direct link to the Helm setting * Final polish, ready to merge
1 parent 32a3fd0 commit 92fa448

9 files changed

+120
-36
lines changed

‎source/includes/admonitions/fact-create-service-account-namespaces.rst

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
.. important::
22

3-
To deploy |onprem| and |k8s-mdbrscs| in a |k8s-ns| other than the one
4-
where you deploy the |k8s-op-short|, see :ref:`k8s-deployment-scopes`
5-
for values you must use and additional steps you might have to
6-
perform.
3+
To deploy |onprem| and |k8s-mdbrscs| to one or more |k8s-nss| other
4+
than the one where you deploy the |k8s-op-short|,
5+
see :ref:`k8s-deployment-scopes` for values you must use and
6+
additional steps you might have to perform.
77

‎source/includes/admonitions/fact-subset-of-namespaces.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Watching a subset of namespaces is useful in deployments with
2+
multiple |k8s-op-short| instances, where each |k8s-op-short| instance
3+
watches a different subset of namespaces in your cluster.

‎source/includes/code-examples/yaml-files/example-watch-namespaces-env-helm.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.. example::
2+
3+
.. code-block:: yaml
4+
:emphasize-lines: 3
5+
6+
# Operator with name `mongodb-enterprise-operator-qa-envs` will
7+
# watch ns-dev, ns-qa and ns-uat namespaces
8+
helm install mongodb-operator helm_chart --set operator.watchNamespace="ns-dev\,ns-qa\,ns-uat" mongodb-enterprise-operator-qa-envs
9+

‎source/includes/code-examples/yaml-files/example-watch-namespaces-staging-only-helm.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.. example::
2+
3+
.. code-block:: yaml
4+
:emphasize-lines: 3
5+
6+
# Operator with name `mongodb-enterprise-operator-staging` will
7+
# watch ns-staging and ns-pre-prod
8+
helm install mongodb-operator helm-chart --set operator.watchNamespace="ns-staging\,ns-pre-prod" mongodb-enterprise-operator-staging
9+

‎source/includes/code-examples/yaml-files/example-watch-one-namespace-helm.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
.. example::
2+
3+
.. code-block:: yaml
4+
:emphasize-lines: 2
5+
6+
# Watch one namespace
7+
helm install mongodb-operator helm_chart --set operator.watchNamespace='namespace-to-watch' <...>
8+

‎source/includes/code-examples/yaml-files/example-watch-two-namespaces-helm.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
.. example::
2+
3+
.. code-block:: yaml
4+
:emphasize-lines: 2
5+
6+
# Watch both namespace-a and namespace-b
7+
helm install mongodb-operator helm_chart --set operator.watchNamespace="namespace-a\,namespace-b"
8+

‎source/includes/op-setting-descs/watch-namespace.rst

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,19 @@
1-
Namespace that the |k8s-op-short| watches for |k8s-mdbrsc|
1+
Namespaces that the |k8s-op-short| watches for |k8s-mdbrsc|
22
changes. If this |k8s-ns| differs from the default, ensure that
3-
the Operator's ServiceAccount :k8sdocs:`can access
3+
the |k8s-op-short| ServiceAccount :k8sdocs:`can access
44
</reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding>`
55
this namespace.
66

7-
Use **\*** to specify *all namespaces*. To watch all namespaces, you
8-
must also assign the |k8s-cr| to the ``mongodb-enterprise-operator``
9-
ServiceAccount, which is the ServiceAccount used to run the
10-
|k8s-op-short|.
7+
- To watch *all namespaces*, specify **\*** and assign the |k8s-cr| to the
8+
``mongodb-enterprise-operator`` ServiceAccount that you use to run the
9+
|k8s-op-short|.
10+
11+
- To watch a *subset of all namespaces*, specify them in a
12+
comma-separated list, escape each comma with a backslash,
13+
and surround the list in quotes, such as
14+
``"operator.watchNamespace=ns1\,ns2"``.
15+
16+
.. include:: /includes/admonitions/fact-subset-of-namespaces.rst
1117

1218
.. include:: /includes/admonitions/fact-create-service-account-namespaces.rst
1319

‎source/reference/helm-operator-settings.txt

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -341,18 +341,20 @@ The default value is **{+version+}**.
341341
operator:
342342
version: {+version+}
343343

344+
.. _helm-watch-namespace:
345+
344346
operator.watchNamespace
345347
-----------------------
346348

347349
.. include:: /includes/op-setting-descs/watch-namespace.rst
348350

349-
.. example::
351+
.. include:: /includes/code-examples/yaml-files/example-watch-one-namespace-helm.yaml
350352

351-
.. code-block:: yaml
352-
:emphasize-lines: 2
353+
.. include:: /includes/code-examples/yaml-files/example-watch-two-namespaces-helm.yaml
353354

354-
operator:
355-
watchNamespace: *
355+
.. include:: /includes/code-examples/yaml-files/example-watch-namespaces-env-helm.yaml
356+
357+
.. include:: /includes/code-examples/yaml-files/example-watch-namespaces-staging-only-helm.yaml
356358

357359
operator.watchedResources
358360
-------------------------

‎source/tutorial/set-scope-k8s-operator.txt

Lines changed: 60 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ You can set one of these scopes:
3131

3232
.. _ns-scope-same-ns:
3333

34-
Operator Uses Same Namespace as Resources
35-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
34+
Operator Uses the Same Single Namespace as Resources
35+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
3636

3737
You can set the scope for the |k8s-op-short| to use the same |k8s-ns| as
3838
resources. In this case, the |k8s-op-short| watches |onprem| and
@@ -43,32 +43,71 @@ uses the default namespace.
4343

4444
.. _ns-scope-different-ns:
4545

46-
Operator Uses Different Namespace than Resources
47-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
46+
Operator Uses a Subset of Namespaces
47+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4848

49-
You can set the scope for the |k8s-op-short| to use a different |k8s-ns|
50-
than its resources. In this case, the |k8s-op-short| watches |onprem|
51-
and |k8s-mdbrscs| in a |k8s-ns| that you specify.
49+
You can set the scope for the |k8s-op-short| to use one or more |k8s-nss|
50+
that differ from the namespace used by the |k8s-op-short| resources.
51+
In this case, the |k8s-op-short| watches |onprem| and |k8s-mdbrscs|
52+
in a subset of |k8s-nss| that you specify.
53+
54+
To install the |k8s-op-short| instances with this
55+
scope, use ``helm`` with the :ref:`helm-watch-namespace` parameter.
56+
57+
.. include:: /includes/admonitions/fact-subset-of-namespaces.rst
5258

53-
You can use ``helm`` to install the |k8s-op-short| with this scope.
5459
Follow the relevant :ref:`installation instructions
55-
<install-k8s-operator>` for ``helm``, but use the following command to
56-
set the namespace for the |k8s-op-short| to watch:
60+
<install-k8s-operator>` for ``helm``, but specify one or more namespaces
61+
in the :ref:`helm-watch-namespace` parameter for the |k8s-op-short| to
62+
watch:
63+
64+
.. include:: /includes/code-examples/yaml-files/example-watch-one-namespace-helm.yaml
65+
66+
.. include:: /includes/code-examples/yaml-files/example-watch-two-namespaces-helm.yaml
67+
68+
.. include:: /includes/code-examples/yaml-files/example-watch-namespaces-env-helm.yaml
69+
70+
.. include:: /includes/code-examples/yaml-files/example-watch-namespaces-staging-only-helm.yaml
71+
72+
When installing the |k8s-op-short| to watch resources in one or more
73+
namespaces other than the namespace in which the |k8s-op-short| is
74+
deployed:
75+
76+
1. Create the following resources:
77+
78+
- A |k8s-cr| with access to multiple resources. For the full resource
79+
definition, see the
80+
:github:`operator-roles.yaml </mongodb/mongodb-enterprise-kubernetes/blob/master/helm_chart/templates/operator-roles.yaml>`
81+
example. This is a cluster-scoped resource.
82+
83+
- A |k8s-crb| on each namespace to watch. This ``clusterRoleBinding``
84+
will bind the ``clusterRole`` you created with the ServiceAccount
85+
the |k8s-op-short| is using on the namespace where you install it.
86+
87+
2. Include the ``clusterRole`` and ``clusterRoleBinding``
88+
in the default configuration files that you apply during the
89+
installation.
90+
91+
The following example illustrates how ``clusterRoles`` and
92+
``clusterRoleBindings`` work together in the cluster.
5793

58-
.. code-block:: sh
94+
Suppose you create a ServiceAccount in the ``mongodb`` namespace, and
95+
then install the |k8s-op-short| in this namespace. The |k8s-op-short|
96+
uses this ServiceAccount.
5997

60-
helm install <chart-name> helm_chart \
61-
--set operator.watchNamespace=<namespace> \
98+
To set the |k8s-op-short| scope to watch namespaces ``ns1`` and ``ns2``:
6299

63-
Setting the namespace ensures that:
100+
1. Obtain :k8sdocs:`cluster-admin privileges </reference/access-authn-authz/rbac/#user-facing-roles>`.
101+
2. Using these privileges, create a cluster-wide, non-namespaced |k8s-cr|.
102+
3. Create a |k8s-crb| in three namespaces: ``mongodb``, ``ns1``
103+
and ``ns2``. This ``clusterRoleBinding`` will bind the
104+
``clusterRole`` to the ServiceAccount in the ``mongodb`` namespace.
105+
The ``clusterRoleBinding`` will allow the |k8s-op-short| deployed in
106+
the ``mongodb`` namespace to access the resources described in the
107+
``clusterRole`` of the target namespace, that is, in ``mongodb``,
108+
``ns1`` and ``ns2``.
64109

65-
- The namespace you want the |k8s-op-short| to watch has the correct
66-
|k8s-cr| and |k8s-crb|. The ``clusterRole`` and ``clusterRoleBinding``
67-
are included in the default configuration files that you apply during
68-
the installation. To create the ``clusterRole`` and
69-
``clusterRoleBinding``, you must have
70-
:k8sdocs:`cluster-admin privileges </reference/access-authn-authz/rbac/#user-facing-roles>`.
71-
- The |k8s-op-short| can watch and create resources in this namespace.
110+
See also :ref:`helm-watch-namespace`.
72111

73112
.. _cluster-wide-scope:
74113

0 commit comments

Comments
 (0)