Apply pre-commit formatting fixes

Auto-generated changes from running pre-commit hooks:
- Fix trailing whitespace
- Fix end-of-file newlines
- Regenerate manifests and release files
- Update licenses

Author: nammn

.evergreen-functions.yml

@@ -496,7 +496,6 @@ functions:
           IMAGE_NAME: ${image_name}
           BUILD_SCENARIO_OVERRIDE: ${build_scenario}
           FLAGS: ${flags}
-          AGENT_VERSION_OVERRIDE: ${agent_version}
 
   teardown_cloud_qa_all:
     - command: shell.exec
@@ -779,20 +778,6 @@ functions:
           GH_TOKEN: ${GH_TOKEN}
         binary: scripts/dev/run_python.sh scripts/release/create_chart_release_pr.py --chart_version ${OPERATOR_VERSION|*triggered_by_git_tag}
 
-  add_releaseinfo_to_github_assets:
-    - command: github.generate_token
-      params:
-        expansion_name: GH_TOKEN
-    - command: subprocess.exec
-      type: setup
-      params:
-        working_dir: src/github.com/mongodb/mongodb-kubernetes
-        include_expansions_in_env:
-          - OPERATOR_VERSION
-        env:
-          GH_TOKEN: ${GH_TOKEN}
-        binary: scripts/dev/run_python.sh scripts/release/release_info.py --version ${OPERATOR_VERSION|*triggered_by_git_tag}
-
   release_kubectl_mongodb_plugin:
     - command: github.generate_token
       params:

.evergreen-mco.yml

@@ -144,4 +144,3 @@ tasks:
 - commands:
   - func: e2e_test
   name: statefulset_arbitrary_config_update
-

.evergreen-release.yml

@@ -115,12 +115,6 @@ tasks:
       - func: install_macos_notarization_service
       - func: release_kubectl_mongodb_plugin
 
-  - name: add_releaseinfo_to_github_assets
-    commands:
-      - func: clone
-      - func: python_venv
-      - func: add_releaseinfo_to_github_assets
-
   - name: create_chart_release_pr
     tags: [ "helm_chart_release_pr" ]
     commands:
@@ -157,18 +151,6 @@ buildvariants:
       - name: release_readiness_probe
       - name: release_version_upgrade_hook
 
-  - name: add_releaseinfo_to_github_assets
-    display_name: add_releaseinfo_to_github_assets
-    tags: ["release"]
-    run_on:
-      - ubuntu2404-small
-    allowed_requesters: ["patch", "github_tag"]
-    depends_on:
-      - name: "*"
-        variant: release_images
-    tasks:
-      - name: add_releaseinfo_to_github_assets
-
   - name: preflight_release_images
     display_name: preflight_release_images
     tags: [ "release" ]

.evergreen-tasks.yml

@@ -1271,8 +1271,7 @@ tasks:
     commands:
       - func: e2e_test
 
-
-  - name : e2e_multi_cluster_sharded_snippets
+  - name: e2e_multi_cluster_sharded_snippets
     tags: [ "patch-run" ]
     commands:
       - func: e2e_test

.evergreen.yml

@@ -13,7 +13,7 @@ include:
 variables:
   - &ops_manager_60_latest 6.0.27 # The order/index is important, since these are anchors. Please do not change
 
-  - &ops_manager_70_latest 7.0.20 # The order/index is important, since these are anchors. Please do not change
+  - &ops_manager_70_latest 7.0.19 # The order/index is important, since these are anchors. Please do not change
 
   - &ops_manager_80_latest 8.0.17 # The order/index is important, since these are anchors. Please do not change
 
@@ -287,21 +287,19 @@ tasks:
     commands:
       - func: lint_repo
 
-  # Runs on every merge - detects release.json changes and releases appropriate images
-  - name: release_om_and_agents
-    allowed_requesters: [ "patch" , "commit"]
+  # pct only triggers this variant once a new agent image is out
+  - name: release_agent
+    # this enables us to run this variant either manually (patch) which pct does or during an OM bump (github_pr)
+    allowed_requesters: [ "patch", "github_pr" ]
     commands:
       - func: clone
-      - func: python_venv
       - func: setup_building_host
       - func: quay_login
       - func: setup_docker_sbom
-      - command: subprocess.exec
-        params:
-          working_dir: src/github.com/mongodb/mongodb-kubernetes
-          binary: scripts/dev/run_python.sh
-          args:
-            - scripts/release/release_om_and_agents.py
+      - func: pipeline
+        vars:
+          image_name: agent
+          build_scenario: release
 
   - name: migrate_all_agents
     # this enables us to run this variant manually to build all the agents for the new agent registry
@@ -345,9 +343,8 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          agent_version: all
           image_name: agent
-          flags: "--parallel --skip-if-exists=false"
+          flags: "--parallel --all-agents --skip-if-exists=false"
 
   - name: rebuild_currently_used_agents
     # this enables us to run this manually (patch) and rebuild current agent versions to verify
@@ -359,9 +356,8 @@ tasks:
       - func: quay_login
       - func: pipeline
         vars:
-          agent_version: current
           image_name: agent
-          flags: "--parallel --skip-if-exists=false"
+          flags: "--parallel --current-agents --skip-if-exists=false"
 
   - name: build_kubectl_mongodb_plugin
     commands:
@@ -467,8 +463,7 @@ tasks:
       - func: pipeline
         vars:
           image_name: agent
-          agent_version: all
-          flags: "--parallel"
+          flags: "--parallel --all-agents"
 
   - name: build_init_database_image_ubi
     commands:
@@ -1898,6 +1893,26 @@ buildvariants:
     tasks:
       - name: build_om_images
 
+    # It will be called by pct while bumping the agent cloud manager image
+  - name: release_agent
+    display_name: release_agent
+    tags: [ "manual_patch", "release_agent" ]
+    run_on:
+      - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    depends_on:
+      - variant: init_test_run
+        name: build_agent_images_ubi # this ensures the agent gets released to ECR as well
+      - variant: e2e_multi_cluster_kind
+        name: '*'
+      - variant: e2e_static_multi_cluster_2_clusters
+        name: '*'
+      - variant: e2e_mdb_kind_ubi_cloudqa
+        name: '*'
+      - variant: e2e_static_mdb_kind_ubi_cloudqa
+        name: '*'
+    tasks:
+      - name: release_agent
+
     # Only called manually, It's used for testing the task release_agents in case the release.json
     # has not changed, and you still want to push the images to registry.
   - name: manual_release_all_agents
@@ -1931,6 +1946,51 @@ buildvariants:
       - name: backup_csv_images_limit_3
       - name: backup_csv_images_all
 
+  - name: publish_om60_images
+    display_name: publish_om60_images
+    tags: [ "manual_patch" ]
+    allowed_requesters: [ "patch", "github_pr" ]
+    run_on:
+      - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    depends_on:
+      - variant: e2e_om60_kind_ubi
+        name: '*'
+      - variant: e2e_static_om60_kind_ubi
+        name: '*'
+    tasks:
+      - name: publish_ops_manager
+      - name: release_agent
+
+  - name: publish_om70_images
+    display_name: publish_om70_images
+    tags: [ "manual_patch" ]
+    allowed_requesters: [ "patch", "github_pr" ]
+    run_on:
+      - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    depends_on:
+      - variant: e2e_om70_kind_ubi
+        name: '*'
+      - variant: e2e_static_om70_kind_ubi
+        name: '*'
+    tasks:
+      - name: publish_ops_manager
+      - name: release_agent
+
+  - name: publish_om80_images
+    display_name: publish_om80_images
+    tags: [ "manual_patch" ]
+    allowed_requesters: [ "patch", "github_pr" ]
+    run_on:
+      - release-ubuntu2404-small # This is required for CISA attestation https://jira.mongodb.org/browse/DEVPROD-17780
+    depends_on:
+      - variant: e2e_om80_kind_ubi
+        name: '*'
+      - variant: e2e_static_om80_kind_ubi
+        name: '*'
+    tasks:
+      - name: publish_ops_manager
+      - name: release_agent
+
   - name: migrate_all_agents
     display_name: migrate_all_agents
     tags: [ "manual_patch" ]
@@ -1939,13 +1999,3 @@ buildvariants:
       - ubuntu2404-large
     tasks:
       - name: migrate_all_agents
-
-  # Runs on every merge to master and releases images auxiliary to the operator release like OM and the Agent
-  - name: release_om_and_agents
-    display_name: release_om_and_agents
-    allowed_requesters: [ "patch" , "commit"]
-    run_on:
-      - release-ubuntu2404-small
-    patchable: false  # Only run on commit builds
-    tasks:
-      - name: release_om_and_agents

.github/ISSUE_TEMPLATE/bug_report.md

@@ -36,13 +36,13 @@ Add any other context about the problem here.
 
 If possible, please include:
  - The operator logs
- - Below we assume that your replicaset database pods are named `mongo-<>`. For instance: 
-```                                                                                      
+ - Below we assume that your replicaset database pods are named `mongo-<>`. For instance:
+```  
 ❯ k get pods
 NAME      READY   STATUS    RESTARTS   AGE
 mongo-0   2/2     Running   0          19h
 mongo-1   2/2     Running   0          19h
-                                                                                     
+
 ❯ k get mdbc
 NAME    PHASE     VERSION
 mongo   Running   4.4.0

LICENSE-MCK

@@ -26,4 +26,3 @@ For more details or to acquire a commercial license, visit https://www.mongodb.c
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-

api/v1/mdb/mongodb_types.go

@@ -1201,20 +1201,6 @@ func (m *MongoDB) GetLastSpec() (*MongoDbSpec, error) {
 	return &lastSpec, nil
 }
 
-func (m *MongoDB) GetLastConfiguredRoles() ([]string, error) {
-	lastRolesStr := annotations.GetAnnotation(m, util.LastConfiguredRoles)
-	if lastRolesStr == "" {
-		return nil, nil
-	}
-
-	lastRoles := []string{}
-	if err := json.Unmarshal([]byte(lastRolesStr), &lastRoles); err != nil {
-		return nil, err
-	}
-
-	return lastRoles, nil
-}
-
 func (m *MongoDB) ServiceName() string {
 	if m.Spec.StatefulSetConfiguration != nil {
 		svc := m.Spec.StatefulSetConfiguration.SpecWrapper.Spec.ServiceName

api/v1/mdbmulti/mongodbmultibuilder.go

@@ -73,14 +73,6 @@ func (m *MultiReplicaSetBuilder) SetSecurity(s *mdbv1.Security) *MultiReplicaSet
 	return m
 }
 
-func (m *MultiReplicaSetBuilder) SetRoles(roles []mdbv1.MongoDBRole) *MultiReplicaSetBuilder {
-	if m.Spec.Security == nil {
-		m.Spec.Security = &mdbv1.Security{}
-	}
-	m.Spec.Security.Roles = roles
-	return m
-}
-
 func (m *MultiReplicaSetBuilder) SetRoleRefs(roleRefs []mdbv1.MongoDBRoleRef) *MultiReplicaSetBuilder {
 	if m.Spec.Security == nil {
 		m.Spec.Security = &mdbv1.Security{}

changelog/20251007_feature_reintroduce_securitycontext_operator_setting_in.md

@@ -3,4 +3,4 @@ kind: feature
 date: 2025-10-07
 ---
 
-* **Helm Chart**: Introduced two new helm fields `operator.podSecurityContext` and `operator.securityContext` that can be used to configure `securityContext` for Operator deployment through Helm Chart. 
+* **Helm Chart**: Introduced two new helm fields `operator.podSecurityContext` and `operator.securityContext` that can be used to configure `securityContext` for Operator deployment through Helm Chart.