From 0aaf5e1e050e582189a53e21693156ffe090831e Mon Sep 17 00:00:00 2001 From: Andrey Kolkov Date: Thu, 17 Sep 2026 10:23:46 +0400 Subject: [PATCH] docs(mongodb): condense the psmdb-backups RBAC comment so it does not ship into the ClusterRole The delete/patch grant justification had grown to an 11-line `#` block, which (unlike a `{{/* */}}` comment) renders verbatim into every cluster's ClusterRole and drifts out of date as the code moves. Condense it to a short pointer at reconcileMongoDB / cleanupMongoDBBackup and the docs, where the detail is versioned; keep only enough to explain the non-obvious grant. Assisted-By: LLM Signed-off-by: Andrey Kolkov --- .../templates/rbac.yaml | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/packages/system/backupstrategy-controller/templates/rbac.yaml b/packages/system/backupstrategy-controller/templates/rbac.yaml index f6486e3dc..a20a0052e 100644 --- a/packages/system/backupstrategy-controller/templates/rbac.yaml +++ b/packages/system/backupstrategy-controller/templates/rbac.yaml @@ -166,17 +166,11 @@ rules: verbs: ["get", "list", "watch", "patch"] - apiGroups: ["psmdb.percona.com"] resources: ["perconaservermongodbbackups"] - # delete: two paths. On the useSystemBucket flow cleanupMongoDBBackup prunes the - # shared-bucket archive on Cozystack Backup deletion by deleting this CR, whose - # delete-backup finalizer frees the object (a legacy backup carries no such - # finalizer, so its own-bucket archive is left). Independently, the BackupJob's - # 30m timeout cancels a not-yet-started operator CR on either flow, so a Failed - # job never leaves a CR the operator would run later (see the deadline branch in - # reconcileMongoDB). - # patch: strip the driver's own delete-backup finalizer to release a wedged - # cleanup (namespace terminating, or the skip-artifact-cleanup annotation) so - # the driver's finalizer is not what holds a tenant namespace in Terminating - # (the operator's own release-lock finalizer can still hold it if it is down). + # delete: prune a useSystemBucket archive by deleting its CR (the delete-backup + # finalizer frees the object), and cancel a not-yet-started CR at the BackupJob + # timeout on either flow. patch: strip the driver's own delete-backup finalizer + # to release a wedged cleanup. See reconcileMongoDB / cleanupMongoDBBackup and + # docs/operations/backup-classes.md. verbs: ["get", "list", "watch", "create", "delete", "patch"] - apiGroups: ["psmdb.percona.com"] resources: ["perconaservermongodbrestores"]