[CLOUDP-349630] Don't generate scramshacreds if MongoDBUser's password is not changed

[viveksinghggits]

Summary

When the reconciliation happens for the MongoDBUser resource (because of controller restart or because of any other reason), for SCRAM authentication mechanism, the scram sha creds are generated and then they are set in the automation config which results into another version getting created for Automation Config.
This workflow can be improved to generated the scram sha creds only when the password of the user is changed. If we do that we will not be changing the user's scram creds and the automation config will not be updated.
To achieve this we are checking if the scram sha creds that are in automation config for a user, match with the scram sha creds generated with the stored salt and new password. If the scram sha creds match it means that the password for the user is not changed and we don't have to generate the new scram sha creds, otherwise new scram sha creds will be generated.

Proof of Work

Unit test:

~/work/opensource/mongodb-kubernetes/controllers/operator/authentication (dont-rotate-scram-creds-mdbu) » go test -timeout 30s -run ^Test_isPasswordChanged$ -v
=== RUN   Test_isPasswordChanged
--- PASS: Test_isPasswordChanged (0.01s)
PASS
ok      github.com/mongodb/mongodb-kubernetes/controllers/operator/authentication       0.472s

I am yet to do some more tests to actually be confident that the automation config is not changed when reconciliation happens.

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you added changelog file?
  • use skip-changelog label if not needed
  • refer to Changelog files and Release Notes section in CONTRIBUTING.md for more details

[github-actions]

⚠️ (this preview might not be accurate if the PR is not rebased on current master branch)

MCK 1.6.1 Release Notes

Bug Fixes

• Backed up the agent password in a secret for SCRAM authentication to prevent unnecessary password rotations.
• MongoDB Adding missing ownerrefs to ensure proper resource deletion by kubernetes.
• Single Cluster Deleting resources created by CRD now only happens on multi-cluster deployments. Single Cluster will solely rely on ownerrefs.
• MongoDB, MongoDBOpsManager: Improve validation for featureCompatibilityVersion field in MongoDB and MongoDBOpsManager spec.
  The field now enforces proper semantic versioning. Previously, invalid semver values could be accepted,
  potentially resulting in incorrect configurations.

[lsierant]

LGTM!

Please look into existing e2e tests which are checking changing passwords and consider adding there a simulated MongoDBUser reconciler to ensure no automation config version is being bumped in the result.

[viveksinghggits]

Hi @lucian-tosa,
Before I merge this, I would like to highlight that because we are changing signature of toOmUser it's also affecting handleExternalAuthUser. Even though we were mainly planning to handle the scram sha authentication as part of this change.
Do you think it's an acceptable change even for external users? If yes, I will go ahead and merge the PR.