admin/cozystack
1
0 Fork 0
mirror of https://github.com/cozystack/cozystack.git synced 2026-10-23 03:27:50 +09:00
Code Issues Packages Projects Releases Wiki Activity

chore: drop private cluster, host and personal names from the tree

Browse Source 
Private infrastructure names, a real hostname, a commented-out
internal mirror block, an internal product name, and a reviewer's
name in a comment do not belong in a public repository; drop them
and replace what needs a stand-in with neutral placeholders.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
This commit is contained in:
Aleksei Sviridkin committed 2026-10-07 04:38:06 +03:00
1 parent d2e3eb4f82
commit 520af57905
18 files changed
+47 -70
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

api/backups/strategy/v1alpha1/etcd_types.go
+2 -2
View File
@@ -107,8 +107,8 @@ type EtcdTemplate struct {
// Until the upstream gains symmetric semantics (or surfaces the final // Until the upstream gains symmetric semantics (or surfaces the final
// file path via the equivalent of BackupSnapshot.URI for PVC), this // file path via the equivalent of BackupSnapshot.URI for PVC), this
// driver intentionally narrows the API contract to S3 only. The S3 // driver intentionally narrows the API contract to S3 only. The S3
// path is fully exercised end-to-end on dev7 and covered by unit + // path is fully exercised end-to-end on a test cluster and covered by
// e2e tests. // unit + e2e tests.
// +kubebuilder:validation:XValidation:rule="has(self.s3)",message="s3 destination is required (PVC is intentionally not supported by this strategy until upstream restore-agent reads the same path the backup-agent writes; see the strategy comments)" // +kubebuilder:validation:XValidation:rule="has(self.s3)",message="s3 destination is required (PVC is intentionally not supported by this strategy until upstream restore-agent reads the same path the backup-agent writes; see the strategy comments)"
type EtcdDestinationTemplate struct { type EtcdDestinationTemplate struct {
// S3 configures an S3-compatible storage target. Templating is // S3 configures an S3-compatible storage target. Templating is
cmd/cozystack-operator/main_test.go
+1 -1
View File
@@ -122,7 +122,7 @@ func TestInstallPlatformPackageSource_Updates(t *testing.T) {
// TestInstallPlatformPackageSource_RefusesTapOwned asserts that when a // TestInstallPlatformPackageSource_RefusesTapOwned asserts that when a
// marketplace tap has materialized a PackageSource under a name the platform // marketplace tap has materialized a PackageSource under a name the platform
// later ships, the platform refuses to overwrite it, names the conflict, and // later ships, the platform refuses to overwrite it, names the conflict, and
// leaves the object untouched (kvaps' review point). // leaves the object untouched.
func TestInstallPlatformPackageSource_RefusesTapOwned(t *testing.T) { func TestInstallPlatformPackageSource_RefusesTapOwned(t *testing.T) {
s := newTestScheme() s := newTestScheme()
tapOwned := &cozyv1alpha1.PackageSource{ tapOwned := &cozyv1alpha1.PackageSource{
docs/oidc-grafana.md
+1 -1
View File
@@ -96,7 +96,7 @@ CR:
`user.Groups` slice empty regardless of what the userinfo endpoint `user.Groups` slice empty regardless of what the userinfo endpoint
returns, and the gate rejects every login with "user not a member returns, and the gate rejects every login with "user not a member
of one of the required groups" — even when the token carries the of one of the required groups" — even when the token carries the
correct claim (verified end-to-end on dev3 with Grafana v11.6.15). correct claim (verified end-to-end on a test cluster with Grafana v11.6.15).
The JMESPath expression `groups` reads the top-level `groups` The JMESPath expression `groups` reads the top-level `groups`
array from userinfo, matching the shape Keycloak's array from userinfo, matching the shape Keycloak's
`oidc-group-membership-mapper` emits. `oidc-group-membership-mapper` emits.
docs/operations/backup-classes.md
+1 -1
View File
@@ -415,7 +415,7 @@ A `recoveryTime` **before the earliest base backup** fails differently: PostgreS
### Discovering the earliest / latest restorable time ### Discovering the earliest / latest restorable time
CNPG's `Cluster.status.firstRecoverabilityPoint` exists in the status schema but is unreliable under the barman-cloud plugin — it was observed empty on every plugin-backed cluster on the dev7 test cluster (CNPG 1.28.1) — so read the window from the backup catalog instead. Each completed base backup records its WAL range and timestamps on the underlying `cnpg.io/Backup`: CNPG's `Cluster.status.firstRecoverabilityPoint` exists in the status schema but is unreliable under the barman-cloud plugin — it was observed empty on every plugin-backed cluster in a test environment (CNPG 1.28.1) — so read the window from the backup catalog instead. Each completed base backup records its WAL range and timestamps on the underlying `cnpg.io/Backup`:
```bash ```bash
# Completed base backups, oldest first: STOP plus one second is the earliest # Completed base backups, oldest first: STOP plus one second is the earliest
hack/e2e-prepare-cluster.bats
-21
View File
@@ -153,27 +153,6 @@ machine:
docker.io: docker.io:
endpoints: endpoints:
- https://mirror.gcr.io - https://mirror.gcr.io
#docker.io:
# endpoints:
# - https://dockerio.nexus.aenix.org
#cr.fluentbit.io:
# endpoints:
# - https://fluentbit.nexus.aenix.org
#docker-registry3.mariadb.com:
# endpoints:
# - https://mariadb.nexus.aenix.org
#gcr.io:
# endpoints:
# - https://gcr.nexus.aenix.org
#ghcr.io:
# endpoints:
# - https://ghcr.nexus.aenix.org
#quay.io:
# endpoints:
# - https://quay.nexus.aenix.org
#registry.k8s.io:
# endpoints:
# - https://k8s.nexus.aenix.org
files: files:
- content: | - content: |
[plugins] [plugins]
internal/backupcontroller/cnpgstrategy_controller.go
+2 -2
View File
@@ -139,8 +139,8 @@ const (
cnpgWALArchiveDeadline = 3 * time.Minute cnpgWALArchiveDeadline = 3 * time.Minute
// Both constants below couple to CNPG/PostgreSQL internals. Verified // Both constants below couple to CNPG/PostgreSQL internals. Verified
// against CNPG 1.28.1 + barman-cloud plugin (postgresql:18.1) on the dev7 // against CNPG 1.28.1 + barman-cloud plugin (postgresql:18.1) on a test
// test cluster. The negative e2e in examples/backups/postgres/run-all.sh // cluster. The negative e2e in examples/backups/postgres/run-all.sh
// (step 46: a recoveryTime past the archive must fail with reason // (step 46: a recoveryTime past the archive must fail with reason
// RecoveryTargetUnreachable) is what catches a drift in either string on // RecoveryTargetUnreachable) is what catches a drift in either string on
// a future CNPG/PostgreSQL bump - if it regresses, this fail-fast silently // a future CNPG/PostgreSQL bump - if it regresses, this fail-fast silently
internal/backupcontroller/etcdstrategy_controller_test.go
+1 -1
View File
@@ -559,7 +559,7 @@ func TestS3KeyFromArtifactURI(t *testing.T) {
} }
// TestResolveEtcdRestoreDestination_PrefersArtifactURIForRevSuffix is // TestResolveEtcdRestoreDestination_PrefersArtifactURIForRevSuffix is
// the integration test for the bug found on dev7: with a v0.4.4 // the integration test for the bug found on a test cluster: with a v0.4.4
// operator (BACKUP_INCLUDE_REVISION=true), the agent wrote // operator (BACKUP_INCLUDE_REVISION=true), the agent wrote
// "etcd/etcd-backup-job-6gghq-rev2.db" but the driver's // "etcd/etcd-backup-job-6gghq-rev2.db" but the driver's
// buildEtcdRestoreS3Key would emit "etcd/etcd-backup-job-6gghq.db" — // buildEtcdRestoreS3Key would emit "etcd/etcd-backup-job-6gghq.db" —
internal/operator/packagesource_reconciler_test.go
+1 -1
View File
@@ -714,7 +714,7 @@ func TestReconcile_DeletionTimestamp_EarlyReturn(t *testing.T) {
} }
// TestUpdateStatus_UnknownWithinGrace_SchedulesFollowUp locks in the fix for // TestUpdateStatus_UnknownWithinGrace_SchedulesFollowUp locks in the fix for
// the dormancy bug caught on dev3: when Ready=Unknown but grace hasn't elapsed // the dormancy bug caught on a test cluster: when Ready=Unknown but grace hasn't elapsed
// yet, artifactGeneratorStuck returns false, we fall through to the copy path // yet, artifactGeneratorStuck returns false, we fall through to the copy path
// and — without an explicit RequeueAfter — the reconciler would sleep until // and — without an explicit RequeueAfter — the reconciler would sleep until
// the AG's next status change (which may never come if it's exactly the // the AG's next status change (which may never come if it's exactly the
packages/apps/kubernetes/templates/oidc-authn-config.yaml
+3 -3
View File
@@ -37,12 +37,12 @@ User identity claim: `email`, not `preferred_username`.
The design doc example used `claim: preferred_username`, but in the The design doc example used `claim: preferred_username`, but in the
cozystack `cozy` realm `preferred_username` is the Keycloak *username* cozystack `cozy` realm `preferred_username` is the Keycloak *username*
(`kvaps`, `i.okhotnikov`), NOT the email — and the operator-facing (`alice`, `j.doe`), NOT the email — and the operator-facing
`users[].email` field asks for the email address. Matching the `User:` `users[].email` field asks for the email address. Matching the `User:`
subject in the ClusterRoleBinding to `preferred_username` would subject in the ClusterRoleBinding to `preferred_username` would
silently misidentify every user whose Keycloak username differs from silently misidentify every user whose Keycloak username differs from
their email — verified on dev3 where token auth succeeded but the CRB their email — verified on a test cluster where token auth succeeded
match failed with 403. but the CRB match failed with 403.
Switching the claim to `email` aligns the apiserver-visible identity Switching the claim to `email` aligns the apiserver-visible identity
with the operator's declared `users[].email` value. Requires the with the operator's declared `users[].email` value. Requires the
packages/apps/kubernetes/tests/oidc_test.yaml
+2 -2
View File
@@ -286,7 +286,7 @@ tests:
- matchRegex: - matchRegex:
path: stringData["config.yaml"] path: stringData["config.yaml"]
pattern: "url: https://keycloak.example.org/realms/cozy" pattern: "url: https://keycloak.example.org/realms/cozy"
# Verified end-to-end on dev3: cozy realm's preferred_username is the # Verified end-to-end: cozy realm's preferred_username is the
# Keycloak *username* (not the email), so a CRB subject sourced from # Keycloak *username* (not the email), so a CRB subject sourced from
# users[].email would silently mis-authenticate. Lock the claim name. # users[].email would silently mis-authenticate. Lock the claim name.
- matchRegex: - matchRegex:
@@ -314,7 +314,7 @@ tests:
# The groups range MUST be wrapped in dyn(): claims.groups is statically # The groups range MUST be wrapped in dyn(): claims.groups is statically
# `any`, and the apiserver rejects a comprehension over `any` at startup # `any`, and the apiserver rejects a comprehension over `any` at startup
# (CrashLoop). Pinning dyn() here makes a regression fail the unit suite # (CrashLoop). Pinning dyn() here makes a regression fail the unit suite
# instead of only surfacing on a live apiserver. Verified on dev3 v1.32. # instead of only surfacing on a live apiserver. Verified on Kubernetes v1.32.
- matchRegex: - matchRegex:
path: stringData["config.yaml"] path: stringData["config.yaml"]
pattern: 'expression: .+has\(claims\.groups\).+dyn\(claims\.groups\)\.exists\(g, g in .+tenant-foo-view.+tenant-foo-use.+tenant-foo-admin.+tenant-foo-super-admin' pattern: 'expression: .+has\(claims\.groups\).+dyn\(claims\.groups\)\.exists\(g, g in .+tenant-foo-view.+tenant-foo-use.+tenant-foo-admin.+tenant-foo-super-admin'
packages/apps/postgres/values.yaml
+1 -1
View File
@@ -197,7 +197,7 @@ quorum:
## CNPG webhook rejects under quorum, and — worse — under server-side apply the phase-2 ## CNPG webhook rejects under quorum, and — worse — under server-side apply the phase-2
## omit prunes the field whenever KEDA has not yet written /scale (e.g. a cluster idle at ## omit prunes the field whenever KEDA has not yet written /scale (e.g. a cluster idle at
## its floor), collapsing it to 1 and decommissioning every replica PVC (see community ## its floor), collapsing it to 1 and decommissioning every replica PVC (see community
## design proposal §Upgrade "Implementation update 2026-09-02"; validated live on dev9). ## design proposal §Upgrade "Implementation update 2026-09-02"; validated live on a test cluster).
## Seeding max(replicas, effectiveMin) — rather than effectiveMin alone — keeps the active ## Seeding max(replicas, effectiveMin) — rather than effectiveMin alone — keeps the active
## branch equal to the disabled/dryRun/transition branch (which renders `instances: ## branch equal to the disabled/dryRun/transition branch (which renders `instances:
## replicas`) whenever `replicas` sits at or above the floor, so enabling, dry-running, or ## replicas`) whenever `replicas` sits at or above the floor, so enabling, dry-running, or
packages/core/installer/example/platform.yaml
+5 -5
View File
@@ -9,12 +9,12 @@ spec:
platform: platform:
values: values:
publishing: publishing:
host: "dev5.infra.aenix.org" host: "example.org"
apiServerEndpoint: "https://api.dev5.infra.aenix.org" apiServerEndpoint: "https://api.example.org"
externalIPs: externalIPs:
- 10.4.0.94 - 192.0.2.10
- 10.4.0.179 - 192.0.2.11
- 10.4.0.26 - 192.0.2.12
authentication: authentication:
oidc: oidc:
enabled: true enabled: true
packages/system/dashboard/images/console/apps/console/src/components/Breadcrumb.tsx
-2
View File
@@ -3,8 +3,6 @@ import { tenantDisplayName, useTenantContext } from "../lib/tenant-context.tsx"
/** /**
* Subtitle bar that sits under the header and surfaces the active tenant. * Subtitle bar that sits under the header and surfaces the active tenant.
* In cozyportal-ui this is where the account/project selectors live; for
* Cozystack we only need the tenant picker.
*/ */
export function Breadcrumb() { export function Breadcrumb() {
const { tenants, selectedTenant, selectTenant, isLoading } = useTenantContext() const { tenants, selectedTenant, selectTenant, isLoading } = useTenantContext()
packages/system/dashboard/images/console/apps/console/src/lib/sidebar-icons.tsx
+1 -1
View File
@@ -69,7 +69,7 @@ const ICON_BY_SLUG: Record<string, SimpleIconData> = Object.fromEntries(
/** /**
* Lucide fallbacks for kinds that don't have a canonical brand logo in * Lucide fallbacks for kinds that don't have a canonical brand logo in
* Simple Icons. These use the same pack as cozyportal-ui. * Simple Icons.
*/ */
const KIND_TO_LUCIDE_ICON: Record<string, LucideIcon | ComponentType<{ className?: string }>> = { const KIND_TO_LUCIDE_ICON: Record<string, LucideIcon | ComponentType<{ className?: string }>> = {
BootBox: Server, BootBox: Server,
packages/system/keda/values.yaml
+1 -1
View File
@@ -107,7 +107,7 @@ keda:
# at the default QPS those polls queue in the client rate limiter ahead of the # at the default QPS those polls queue in the client rate limiter ahead of the
# leader-election lease renewal, which then misses its deadline and the manager # leader-election lease renewal, which then misses its deadline and the manager
# exits with "leader election lost" (observed crash-looping the single-replica # exits with "leader election lost" (observed crash-looping the single-replica
# operator on dev9). A higher ceiling keeps the renewal call from starving. # operator on a test cluster). A higher ceiling keeps the renewal call from starving.
extraArgs: extraArgs:
keda: keda:
kube-api-qps: 50 kube-api-qps: 50
packages/system/linstor-gui/tests/ingress_auth_test.yaml
+22 -22
View File
@@ -43,7 +43,7 @@ tests:
template: templates/ingress.yaml template: templates/ingress.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
expose-services: "dashboard,linstor-gui" expose-services: "dashboard,linstor-gui"
expose-ingress: "tenant-root" expose-ingress: "tenant-root"
@@ -57,7 +57,7 @@ tests:
value: tenant-root value: tenant-root
- equal: - equal:
path: spec.rules[0].host path: spec.rules[0].host
value: linstor-gui.dev10.example.org value: linstor-gui.example.org
- equal: - equal:
path: spec.rules[0].http.paths[0].backend.service.name path: spec.rules[0].http.paths[0].backend.service.name
value: linstor-gui-gatekeeper value: linstor-gui-gatekeeper
@@ -99,7 +99,7 @@ tests:
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
oidc-insecure-skip-verify: "false" oidc-insecure-skip-verify: "false"
keycloak-internal-url: "" keycloak-internal-url: ""
@@ -121,10 +121,10 @@ tests:
content: --upstream=http://linstor-gui.cozy-linstor.svc:80 content: --upstream=http://linstor-gui.cozy-linstor.svc:80
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --redirect-url=https://linstor-gui.dev10.example.org/oauth2/callback content: --redirect-url=https://linstor-gui.example.org/oauth2/callback
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy content: --oidc-issuer-url=https://keycloak.example.org/realms/cozy
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --scope=openid email profile groups content: --scope=openid email profile groups
@@ -151,7 +151,7 @@ tests:
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
keycloak-internal-url: http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy keycloak-internal-url: http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy
expose-services: "linstor-gui" expose-services: "linstor-gui"
@@ -173,19 +173,19 @@ tests:
content: --backend-logout-url=http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token} content: --backend-logout-url=http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token}
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --redirect-url=https://linstor-gui.dev10.example.org/oauth2/callback content: --redirect-url=https://linstor-gui.example.org/oauth2/callback
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --login-url=https://keycloak.dev10.example.org/realms/cozy/protocol/openid-connect/auth content: --login-url=https://keycloak.example.org/realms/cozy/protocol/openid-connect/auth
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy content: --oidc-issuer-url=https://keycloak.example.org/realms/cozy
- it: an explicit keycloak-internal-url override wins over the default - it: an explicit keycloak-internal-url override wins over the default
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
keycloak-internal-url: http://keycloak.example.test:8080/realms/other keycloak-internal-url: http://keycloak.example.test:8080/realms/other
expose-services: "linstor-gui" expose-services: "linstor-gui"
@@ -220,7 +220,7 @@ tests:
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
keycloak-internal-url: "" keycloak-internal-url: ""
expose-services: "linstor-gui" expose-services: "linstor-gui"
@@ -230,10 +230,10 @@ tests:
content: --skip-oidc-discovery content: --skip-oidc-discovery
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy content: --oidc-issuer-url=https://keycloak.example.org/realms/cozy
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --backend-logout-url=https://keycloak.dev10.example.org/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token} content: --backend-logout-url=https://keycloak.example.org/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token}
- notContains: - notContains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --redeem-url=http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy/protocol/openid-connect/token content: --redeem-url=http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy/protocol/openid-connect/token
@@ -254,7 +254,7 @@ tests:
- v1.edp.epam.com/v1 - v1.edp.epam.com/v1
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
asserts: asserts:
- hasDocuments: - hasDocuments:
count: 3 count: 3
@@ -282,7 +282,7 @@ tests:
- documentIndex: 2 - documentIndex: 2
contains: contains:
path: spec.redirectUris path: spec.redirectUris
content: "https://linstor-gui.dev10.example.org/oauth2/callback/*" content: "https://linstor-gui.example.org/oauth2/callback/*"
- it: skips the KeycloakClient CRD when the API is absent, still creates Secrets - it: skips the KeycloakClient CRD when the API is absent, still creates Secrets
template: templates/keycloakclient.yaml template: templates/keycloakclient.yaml
@@ -307,7 +307,7 @@ tests:
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
oidc-realm-name: acme oidc-realm-name: acme
keycloak-internal-url: http://keycloak-http.cozy-keycloak.svc:8080/realms/acme keycloak-internal-url: http://keycloak-http.cozy-keycloak.svc:8080/realms/acme
@@ -315,13 +315,13 @@ tests:
asserts: asserts:
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/acme content: --oidc-issuer-url=https://keycloak.example.org/realms/acme
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --login-url=https://keycloak.dev10.example.org/realms/acme/protocol/openid-connect/auth content: --login-url=https://keycloak.example.org/realms/acme/protocol/openid-connect/auth
- notContains: - notContains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --oidc-issuer-url=https://keycloak.dev10.example.org/realms/cozy content: --oidc-issuer-url=https://keycloak.example.org/realms/cozy
# The external-discovery branch (empty internal URL) builds its own # The external-discovery branch (empty internal URL) builds its own
# backend-logout-url on the browser host; its realm segment must follow # backend-logout-url on the browser host; its realm segment must follow
@@ -330,7 +330,7 @@ tests:
template: templates/gatekeeper.yaml template: templates/gatekeeper.yaml
set: set:
_cluster: _cluster:
root-host: dev10.example.org root-host: example.org
oidc-enabled: "true" oidc-enabled: "true"
oidc-realm-name: acme oidc-realm-name: acme
keycloak-internal-url: "" keycloak-internal-url: ""
@@ -341,7 +341,7 @@ tests:
content: --skip-oidc-discovery content: --skip-oidc-discovery
- contains: - contains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --backend-logout-url=https://keycloak.dev10.example.org/realms/acme/protocol/openid-connect/logout?id_token_hint={id_token} content: --backend-logout-url=https://keycloak.example.org/realms/acme/protocol/openid-connect/logout?id_token_hint={id_token}
- notContains: - notContains:
path: spec.template.spec.containers[0].args path: spec.template.spec.containers[0].args
content: --backend-logout-url=https://keycloak.dev10.example.org/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token} content: --backend-logout-url=https://keycloak.example.org/realms/cozy/protocol/openid-connect/logout?id_token_hint={id_token}
packages/system/monitoring/templates/grafana/grafana.yaml
+1 -1
View File
@@ -140,7 +140,7 @@ spec:
userinfo endpoint returns, and the `allowed_groups` gate rejects userinfo endpoint returns, and the `allowed_groups` gate rejects
every login with "user not a member of one of the required every login with "user not a member of one of the required
groups" — even when the token carries the correct claim. Verified groups" — even when the token carries the correct claim. Verified
end-to-end on dev3 with Grafana v11.6.15: id_token AND userinfo end-to-end on a test cluster with Grafana v11.6.15: id_token AND userinfo
both contained `groups: [<ns>-super-admin, ...]`, `allowed_groups` both contained `groups: [<ns>-super-admin, ...]`, `allowed_groups`
listed `<ns>-super-admin`, but login failed until listed `<ns>-super-admin`, but login failed until
`groups_attribute_path=groups` was added. JMESPath expression `groups_attribute_path=groups` was added. JMESPath expression
packages/system/monitoring/tests/oidc_test.yaml
+2 -2
View File
@@ -102,7 +102,7 @@ tests:
name: GF_PATHS_CUSTOM_INI name: GF_PATHS_CUSTOM_INI
- it: mode=None does NOT render the users-Job (upgrade safety guard) - it: mode=None does NOT render the users-Job (upgrade safety guard)
# Regression guard against the dev3 test finding: if the Job were # Regression guard against a test-cluster finding: if the Job were
# rendered in mode=None, the post-upgrade prune pass would silently # rendered in mode=None, the post-upgrade prune pass would silently
# delete every non-admin Main-Org member on any monitoring HR # delete every non-admin Main-Org member on any monitoring HR
# reconcile — clobbering users added manually through the Grafana # reconcile — clobbering users added manually through the Grafana
@@ -273,7 +273,7 @@ tests:
# groups_attribute_path is REQUIRED alongside allowed_groups on # groups_attribute_path is REQUIRED alongside allowed_groups on
# Grafana v11.x+ — without it Grafana leaves the extracted # Grafana v11.x+ — without it Grafana leaves the extracted
# user.Groups slice empty and the allowed_groups gate rejects # user.Groups slice empty and the allowed_groups gate rejects
# every login (verified end-to-end on dev3 with v11.6.15). "groups" # every login (verified end-to-end on a test cluster with v11.6.15). "groups"
# points at the top-level `groups` array from userinfo — the # points at the top-level `groups` array from userinfo — the
# shape Keycloak's oidc-group-membership-mapper emits. # shape Keycloak's oidc-group-membership-mapper emits.
- equal: - equal: