An entry with an empty sourceSecretName sent the reconciler to Get a
Secret with an empty name. The apiserver answers that with "resource
name may not be empty" — not NotFound — so it escaped the not-found
branch, was returned from Reconcile, and wedged the sentinel on
exponential backoff. The error path returns before any status write, so
no Ready condition was ever recorded: the silent retry the sentinel was
introduced to make visible.
Pin sourceSecretName to MinLength=1 so a live apiserver rejects it at
admission, and guard the reconcile so an object admitted by an older CRD
resolves to Ready=False/SourceInvalid instead of an error.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Introduce the namespaced internal.cozystack.io/v1alpha1 group and its
TenantProjection kind. A chart renders this sentinel to declare which
of an application's Secrets should be published to its tenant as a
key-free copy; the controller reconciles the projected Secret from it.
No tenant RBAC role grants any verb on internal.cozystack.io, so the
sentinel cannot be forged from a tenant namespace.
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin