[cwrau]

Thanks for taking the time to contribute to clickhouse-operator!

Please, read carefully instructions on how to make a Pull Request.

This will help a lot for maintainers to adopt your Pull Request.

Important items to consider before making a Pull Request

Please check items PR complies to:

• All commits in the PR are squashed. More info
• The PR is made into dedicated next-release branch, not into master branch¹. More info
• The PR is signed. More info

--

¹ If you feel your PR does not affect any Go-code or any testable functionality (for example, PR contains docs only or supplementary materials), PR can be made into master branch, but it has to be confirmed by project's maintainer.

Description

Users who are bound to the builtin view, edit or admin ClusterRoles cannot see or manage the operator's custom resources, so they need hand-written RBAC for them. Kubernetes lets aggregated ClusterRoles extend the builtin ones through rbac.authorization.k8s.io/aggregate-to-{view,edit,admin} labels. This PR adds such roles to the Helm chart (templates/aggregated-clusterroles.yaml).

Three ClusterRoles are created, named <fullname>-aggregate-view, -aggregate-edit and -aggregate-view-sensitive:

Kind	view	edit, admin
ClickHouseInstallation	-	read, write
ClickHouseInstallationTemplate	read	read, write
ClickHouseOperatorConfiguration	read	read, write
ClickHouseKeeperInstallation	read	read, write

• The builtin edit and admin roles do not inherit view, so the read role carries all three labels.
• ClickHouseInstallation is not readable by view. The operator writes the normalized CR into status.normalized / status.normalizedCompleted, including the password_sha256_hex hashes it derives for users, and a CHI can also carry inline users, passwords and config in its spec. Reads therefore sit in a separate -aggregate-view-sensitive role labelled for edit and admin only. edit and admin can read all Secrets in a namespace anyway.
• The roles are created by default and can be turned off with rbac.aggregate.enabled=false. They also require rbac.create.
• Write verbs are create, delete, deletecollection, patch, update.

Also changed: values.yaml, values.schema.json, chart README.md (helm-docs), docs/operator_installation_details.md, CHANGELOG.md (entry under 0.28.0, "Added"), and dev/test_helm_chart.sh (rendering assertions for labels, verbs, covered kinds and the two switches).

The chart version is not bumped in this PR; I assume the release process does that.

Testing

• dev/test_helm_chart.sh: 43 checks pass, including the README drift check (helm-docs).
• helm lint passes.
• With aggregate-to-view added to the sensitive role in a scratch copy of the chart, 3 of the new checks fail (CHI readable by view, wrong labels on the sensitive role), so the assertions catch a regression.
• Not tested against a live cluster.