[Feature] AutoDiscover Operator Access (#1863)

Author: ajanikow

CHANGELOG.md

@@ -7,6 +7,7 @@
 - (Maintenance) Unify References via golangci-linter
 - (Feature) Add Default Container Mods
 - (Documentation) Improve Charts and Upgrade Documentation
+- (Feature) AutoDiscover Operator Access
 
 ## [1.2.47](https://github.com/arangodb/kube-arangodb/tree/1.2.47) (2025-03-28)
 - (Bugfix) Use Profile Annotations

README.md

@@ -199,7 +199,7 @@ Flags:
       --kubernetes.max-batch-size int                          Size of batch during objects read (default 256)
       --kubernetes.qps float32                                 Number of queries per second for k8s API (default 32)
       --log.format string                                      Set log format. Allowed values: 'pretty', 'JSON'. If empty, default format is used (default "pretty")
-      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
+      --log.level stringArray                                  Set log levels in format <level> or <logger>=<level>. Possible loggers: action, agency, api-server, assertion, backup-operator, chaos-monkey, crd, deployment, deployment-ci, deployment-reconcile, deployment-replication, deployment-resilience, deployment-resources, deployment-storage, deployment-storage-pc, deployment-storage-service, generic-parent-operator, helm, http, inspector, integration-authn-v1, integration-config-v1, integration-envoy-auth-v3, integration-scheduler-v2, integration-storage-v1-s3, integration-storage-v2, integrations, k8s-client, kubernetes-access, kubernetes-client, kubernetes-informer, monitor, networking-route-operator, operator, operator-arangojob-handler, operator-v2, operator-v2-event, operator-v2-worker, panics, platform-chart-operator, platform-pod-shutdown, platform-storage-operator, pod_compare, root, root-event-recorder, scheduler-batchjob-operator, scheduler-cronjob-operator, scheduler-deployment-operator, scheduler-pod-operator, scheduler-profile-operator, server, server-authentication, webhook (default [info])
       --log.sampling                                           If true, operator will try to minimize duplication of logging events (default true)
       --log.stdout                                             If true, operator will log to the stdout (default true)
       --memory-limit uint                                      Define memory limit for hard shutdown and the dump of goroutines. Used for testing
@@ -219,7 +219,6 @@ Flags:
       --operator.storage                                       Enable to run the ArangoLocalStorage operator
       --operator.version                                       Enable only version endpoint in Operator
       --reconciliation.delay duration                          Delay between reconciliation loops (<= 0 -> Disabled)
-      --scope string                                           Define scope on which Operator works. Legacy - pre 1.1.0 scope with limited cluster access (default "legacy")
       --server.admin-secret-name string                        Name of secret containing username + password for login to the dashboard (default "arangodb-operator-dashboard")
       --server.allow-anonymous-access                          Allow anonymous access to the dashboard
       --server.host string                                     Host to listen on (default "0.0.0.0")

chart/kube-arangodb-arm64/templates/crd/cluster-role.yaml

@@ -17,23 +17,23 @@ rules:
 # analytics.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "graphanalyticsengines.analytics.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.apps -}}
 # apps.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangojobs.apps.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.backup -}}
 # backup.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangobackuppolicies.backup.arangodb.com"
       - "arangobackups.backup.arangodb.com"
@@ -42,7 +42,7 @@ rules:
 # database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoclustersynchronizations.database.arangodb.com"
       - "arangodeployments.database.arangodb.com"
@@ -53,7 +53,7 @@ rules:
 # ml.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangomlbatchjobs.ml.arangodb.com"
       - "arangomlcronjobs.ml.arangodb.com"
@@ -64,23 +64,23 @@ rules:
 # networking.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoroutes.networking.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.deploymentReplications -}}
 # replication.database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangodeploymentreplications.replication.database.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.scheduler -}}
 # scheduler.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoprofiles.scheduler.arangodb.com"
       - "arangoschedulerpods.scheduler.arangodb.com"
@@ -92,7 +92,7 @@ rules:
 # platform.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoplatformcharts.platform.arangodb.com"
       - "arangoplatformstorages.platform.arangodb.com"

chart/kube-arangodb-arm64/templates/deployment.yaml

@@ -92,7 +92,6 @@ spec:
                   imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
                   image: {{ .Values.operator.image }}
                   args:
-                    - --scope={{ .Values.operator.scope }}
 {{- if .Values.certificate.enabled }}
                     - --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
                     - --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert

chart/kube-arangodb-enterprise-arm64/templates/crd/cluster-role.yaml

@@ -17,23 +17,23 @@ rules:
 # analytics.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "graphanalyticsengines.analytics.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.apps -}}
 # apps.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangojobs.apps.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.backup -}}
 # backup.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangobackuppolicies.backup.arangodb.com"
       - "arangobackups.backup.arangodb.com"
@@ -42,7 +42,7 @@ rules:
 # database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoclustersynchronizations.database.arangodb.com"
       - "arangodeployments.database.arangodb.com"
@@ -53,7 +53,7 @@ rules:
 # ml.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangomlbatchjobs.ml.arangodb.com"
       - "arangomlcronjobs.ml.arangodb.com"
@@ -64,23 +64,23 @@ rules:
 # networking.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoroutes.networking.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.deploymentReplications -}}
 # replication.database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangodeploymentreplications.replication.database.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.scheduler -}}
 # scheduler.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoprofiles.scheduler.arangodb.com"
       - "arangoschedulerpods.scheduler.arangodb.com"
@@ -92,7 +92,7 @@ rules:
 # platform.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoplatformcharts.platform.arangodb.com"
       - "arangoplatformstorages.platform.arangodb.com"

chart/kube-arangodb-enterprise-arm64/templates/deployment.yaml

@@ -92,7 +92,6 @@ spec:
                   imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
                   image: {{ .Values.operator.image }}
                   args:
-                    - --scope={{ .Values.operator.scope }}
 {{- if .Values.certificate.enabled }}
                     - --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
                     - --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert

chart/kube-arangodb-enterprise/templates/crd/cluster-role.yaml

@@ -17,23 +17,23 @@ rules:
 # analytics.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "graphanalyticsengines.analytics.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.apps -}}
 # apps.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangojobs.apps.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.backup -}}
 # backup.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangobackuppolicies.backup.arangodb.com"
       - "arangobackups.backup.arangodb.com"
@@ -42,7 +42,7 @@ rules:
 # database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoclustersynchronizations.database.arangodb.com"
       - "arangodeployments.database.arangodb.com"
@@ -53,7 +53,7 @@ rules:
 # ml.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangomlbatchjobs.ml.arangodb.com"
       - "arangomlcronjobs.ml.arangodb.com"
@@ -64,23 +64,23 @@ rules:
 # networking.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoroutes.networking.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.deploymentReplications -}}
 # replication.database.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangodeploymentreplications.replication.database.arangodb.com"
 {{- end }}
 {{ if .Values.operator.features.scheduler -}}
 # scheduler.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoprofiles.scheduler.arangodb.com"
       - "arangoschedulerpods.scheduler.arangodb.com"
@@ -92,7 +92,7 @@ rules:
 # platform.arangodb.com
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
-    verbs: ["get", "list", "watch", "update"]
+    verbs: [{{ if .Values.operator.enableCRDCreation }}"create", {{ end }}"get", "list", "watch", "update"]
     resourceNames:
       - "arangoplatformcharts.platform.arangodb.com"
       - "arangoplatformstorages.platform.arangodb.com"

chart/kube-arangodb-enterprise/templates/deployment.yaml

@@ -92,7 +92,6 @@ spec:
                   imagePullPolicy: {{ .Values.operator.imagePullPolicy }}
                   image: {{ .Values.operator.image }}
                   args:
-                    - --scope={{ .Values.operator.scope }}
 {{- if .Values.certificate.enabled }}
                     - --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
                     - --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert