MLE-30476/BUGFix-manager-rbac

[rwinieski]

This pull request updates the RBAC (Role-Based Access Control) configuration for the MarkLogic Operator to ensure correct permissions for managing Kubernetes events, persistent volume claims (PVCs), and storage classes. The changes add necessary permissions for the operator to emit events, manage PVCs (including their status), and, importantly, introduce a dedicated ClusterRole and ClusterRoleBinding for reading storage classes, which is required for PVC resizing operations in namespace mode.

RBAC enhancements for operator functionality:

Event and PVC permissions:

• Added permissions for the operator to create, patch, and update events in both the core ("") and events.k8s.io API groups, ensuring it can emit Kubernetes events as needed. [1] [2] [3] [4]
• Granted the operator permissions to get, list, patch, update, and watch persistentvolumeclaims and to get persistentvolumeclaims/status, supporting advanced PVC management. [1] [2]

StorageClass access for PVC resizing:

• Introduced a dedicated ClusterRole and ClusterRoleBinding (marklogic-operator-storageclass-reader) to allow the operator to get, list, and watch storageclasses, which is necessary for reading allowVolumeExpansion and performing PVC resize operations. This addresses the limitation that storage classes are cluster-scoped and cannot be managed by a namespaced Role. [1] [2] [3]

[Copilot]

Pull request overview

This pull request updates the Helm chart RBAC for the MarkLogic Operator to support additional operator behaviors (emitting Kubernetes Events and reading StorageClasses), including namespace-scoped mode where StorageClasses require cluster-scoped RBAC.

Changes:

• Added RBAC permissions for creating/patching/updating events in both core ("") and events.k8s.io API groups.
• Added RBAC permissions to read storageclasses, including introducing a namespace-mode ClusterRole/ClusterRoleBinding for StorageClass reads.
• Updated the helmify post-processing script to generate the corresponding RBAC blocks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
hack/helmify-post-process.sh	Updates the generated manager-rbac.yaml template content to include Events/PVC/StorageClass-related RBAC.
charts/marklogic-operator-kubernetes/templates/manager-rbac.yaml	Extends chart RBAC to allow emitting Events and reading StorageClasses; adds namespace-mode StorageClass reader ClusterRole/Binding.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.