Wire the reconciler into the platform controller manager and grant its
ServiceAccount the Secret verbs the projection needs: create/update/patch
to publish the trust anchor, and delete to withdraw it when an application
stops publishing one. Read was already covered by the catch-all rule, and
no tenant RBAC is widened.
Give the reconciler its own dedicated, scoped Secret cache rather than
narrowing the manager's shared cache. Only labelled CA sources are held in
that informer, so a cluster-wide Secret watch never caches every Secret,
and so every private key, in the cluster; the operator-owned name-driven
sources and the projections are read through the uncached API reader
instead. A private cache also keeps this scoping independent of any other
controller on the same manager that needs to scope Secrets differently.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
The operator-provided wildcard MVP serves the root tenant only: the root
ingress controller and Gateway read a TLS Secret from their own namespace.
Child tenants run their own ingress controller / Gateway in a separate,
default-deny namespace and cannot read that Secret cross-namespace.
Add a controller that mirrors the operator wildcard Secret into every
tenant namespace that owns a TLS termination point (its
namespace.cozystack.io/ingress or .../gateway label equals its own name).
The source is identified by name from the platform values channel
(_cluster.wildcard-secret-name) with no extra operator input; replicas
carry a managed-by label and refresh on rotation. An individual replica is
removed when its namespace stops terminating TLS; every replica is torn
down only on an explicit disable (clearing wildcard-secret-name). A missing
or mistyped source, or a transiently-absent values channel, keeps existing
replicas, so tenant TLS never drops on a transient gap. The controller's
Secret cache is scoped to managed replicas and the values channel, not
every cluster Secret. Only the platform controller's ServiceAccount gains
Secret writes — no tenant RBAC is widened, and every consumer reads only
its own-namespace copy.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin