The chart tests named the tenant egress policy as one of the parties
the pod label and port are pinned for. That policy is gone, so the
notes now name only the Service and the console nginx, which still
depend on them.
Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
Nothing the proxy does reads ApplicationDefinitions, so the rule for
them is dropped. Namespaces are read through an informer, which only
lists and watches, so get is dropped as well.
Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
Tenants read their logs, and later their metrics, through an
authorizing proxy that sits in front of the VictoriaLogs and
VictoriaMetrics read paths, so the proxy needs a deployable package
before the console or tenant Grafana can reach it.
The proxy reviews every token and access decision against the API
server, so its own role is limited to creating TokenReviews and
SubjectAccessReviews and reading ApplicationDefinitions and namespaces.
The namespace logs root is authorized as list on cozystack.io logs,
which no API server serves; the rule is aggregated into the tenant view
role so that a namespace viewer passes that review, as upstream grants
pods/log at view.
The image ref lands without a digest until the first build stamps it,
and the package joins the root build list so every build path refreshes
it.
Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>
ZverGuy