Aleksei Sviridkin 73f6382d30 feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants ...

Per-app TLS issues a per-release self-signed CA, but the only objects
that carry ca.crt — the cert-manager CA and leaf Secrets — also carry
private keys. Granting a tenant read on those to obtain the trust
anchor also hands over a server or CA private key.

Add cozy-lib.tls.caCertSecret, which renders a canonical Opaque Secret
holding only ca.crt and labelled internal.cozystack.io/tenantresource=
true. The tenantsecret registry surfaces label-bearing Secrets under
core.cozystack.io/tenantsecrets, which the base tenant roles already
grant, so tenants reach the trust anchor without any grant on a Secret
that contains tls.key. The helper fails closed on empty input and
refuses any PEM carrying private key material.

Covered by helm-unittest in the cozy-lib test chart.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-06-23 03:12:17 +03:00

..

cozy-lib

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

testfile

Remove user-facing config of limits and requests

2025-05-23 17:32:42 +03:00