CLOUDP-178750: Add deletion protection to deployments

[josvazg]

All Submissions:

• Have you signed our CLA?
• Put closes #XXXX in your comment to auto-close the issue that your PR fixes (if there is one).
• Update docs/release-notes/release-notes.md if your changes should be included in the release notes for the next release.

[github-actions]

https://app.codecov.io/github/mongodb/mongodb-atlas-kubernetes/commit/94bb692efa21da22d8888f281c0dd9886f9c4857

[josvazg]

Ownership check is incomplete, will follow up on it soon.

[josvazg]

Ownership checks are now included, I wonder if we need any custom data transformation in the matching functions, like data format normalization.

[josvazg]

Just migrated unit tests to use Atlas service mocks instead of the http client mock.

[josvazg]

The current CI issues with deployment-annotation-ns do not seem flakyness, there is an issue with ownership checking. It finds differences:

  	... // 13 identical fields
  	PitEnabled: &false,
  	StateName:  "IDLE",
  	ReplicationSpecs: []*mongodbatlas.AdvancedReplicationSpec{
  		&{
  			NumShards: 1,
  			ID:        "64d4091c69c4e9090c82f155",
  			ZoneName:  "Zone 1",
  			RegionConfigs: []*mongodbatlas.AdvancedRegionConfig{
  				&{
  					AnalyticsAutoScaling: nil,
- 					AnalyticsSpecs:       nil,
+ 					AnalyticsSpecs:       &mongodbatlas.Specs{InstanceSize: "M2", NodeCount: &0},
  					ElectableSpecs: &mongodbatlas.Specs{
  						DiskIOPS:      nil,
  						EbsVolumeType: "",
  						InstanceSize:  "M2",
- 						NodeCount:     nil,
+ 						NodeCount:     &3,
  					},
- 					ReadOnlySpecs:       nil,
+ 					ReadOnlySpecs:       &mongodbatlas.Specs{InstanceSize: "M2", NodeCount: &0},
  					AutoScaling:         nil,
  					BackingProviderName: "AWS",
  					... // 3 identical fields
  				},
  			},
  		},
  	},
  	CreateDate:   "2023-08-09T21:46:04Z",
  	RootCertType: "ISRGROOTX1",
  	... // 3 identical fields

I will check the test sequence in detail. In theory, this should not happen, as the operator should have taken control of the deployment, by annotating the previous config. Once that happens, it should not have to re-check for differences. Also, this deployment is created by the operator, so not sure how it can lose ownership like in this test. Will debug.

[josvazg]

Fix applied before I got the go.mod issue:

• The ownership check must only be affected by the protection configuration flag, not by the annotations to keep or not the object. That way protection off bypass all ownership checks, as expected.
• The test that was failing would fail with protection off. The Atlas deployment left there cannot be re-sync at redeployment time, as it will find differences and thus will fail to grab ownership of the object.

% git diff
diff --git a/pkg/controller/atlasdeployment/atlasdeployment_controller.go b/pkg/controller/atlasdeployment/atlasdeployment_controller.go
index 6276f9c..5aa1843 100644
--- a/pkg/controller/atlasdeployment/atlasdeployment_controller.go
+++ b/pkg/controller/atlasdeployment/atlasdeployment_controller.go
@@ -236,13 +236,13 @@ func (r *AtlasDeploymentReconciler) checkDeploymentIsManaged(
                dply.Spec.DeploymentSpec = nil
        }
 
-       isProtected := customresource.IsResourceProtected(dply, r.ObjectDeletionProtection)
        owner, err := customresource.IsOwner(
                dply,
-               isProtected,
+               r.ObjectDeletionProtection,
                customresource.IsResourceManagedByOperator,
                managedByAtlas(context, workflowCtx.Client, project.ID(), log),
        )
+
        if err != nil {
                result := workflow.Terminate(workflow.Internal, fmt.Sprintf("unable to resolve ownership for deletion protection: %s", err))
                workflowCtx.SetConditionFromResult(status.DatabaseUserReadyType, result)
diff --git a/test/e2e/annotations_test.go b/test/e2e/annotations_test.go
index 03b895b..84a71c9 100644
--- a/test/e2e/annotations_test.go
+++ b/test/e2e/annotations_test.go
@@ -31,6 +31,7 @@ var _ = Describe("Annotations base test.", Label("deployment-annotations-ns"), f
                        testData = test
                        mainCycle(test)
                },
+               // TODO: fix test for deletion protection on, as it would fail to re-take the cluster after deletion
                Entry("Simple configuration with keep resource policy annotation on deployment", Label("ns-crd"),
                        model.DataProvider(
                                "operator-ns-crd",

[josvazg]

go.mod issue fixed (missed a go mod tidy)

[igor-karpukhin]

Looks good 👍

[roothorp]

Love all the testing :D