mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-06 03:57:52 +09:00
Myasnikov Daniil
d00ae9d14c
Introduces a new opt-in system package that provisions an admin-facing GitOps surface: a Flux GitRepository + Kustomization in cozy-system reconciling an admin-owned git repo of cluster customizations via a curated ServiceAccount. The admin uses this to manage Package CR patches (e.g. OIDC enable, MetalLB option overrides) and bring their own HelmReleases / Keycloak realm imports / NetworkPolicies as code in a repo they own, rather than via in-cluster kubectl patch. Wired into the platform chart via a single `customizer.enabled` flag in values; off by default. When enabled, emits the cozystack.customizer Package CR through the existing bundles/system.yaml path and respects bundles.disabledPackages. Curated ClusterRole grants patch (not delete) on packages.cozystack.io, read-only on platform HelmReleases, full ownership of PackageSources + admin-owned namespaces (default: cozy-customizer), and Keycloak realm CRs. Explicitly does NOT grant delete on Packages, anything on CRDs, the cozystack-controller Deployment, or kube-system. NOTE: this MVP ships the GitOps surface only. The field-ownership contract documented in the package values is currently advisory; a validating admission webhook on packages.cozystack.io is the planned enforcement (kustomize-controller hardcodes client.ForceOwnership on Apply, so SSA conflict detection cannot block silent ownership transfer at the Flux layer). Risk callout is inline in the values block. Includes helm-unittest coverage for the bundle wiring (off, on with values, disabledPackages override). Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
35 lines
1.3 KiB
YAML
35 lines
1.3 KiB
YAML
source:
|
|
# https://github.com/myorg/cozystack-customizer or ssh://... — required when enabled.
|
|
url: ""
|
|
ref:
|
|
branch: main
|
|
# Secret in {{ .Release.Namespace }} with git credentials. Admin pre-creates;
|
|
# this chart does not generate it (the platform must never own admin credentials).
|
|
secretRef: ""
|
|
interval: 1m
|
|
|
|
kustomization:
|
|
# Path inside the customizer repo that the Kustomization reconciles.
|
|
path: ""
|
|
interval: 5m
|
|
prune: true
|
|
wait: true
|
|
# decryption block per https://fluxcd.io/flux/components/kustomize/kustomizations/#decryption
|
|
decryption: {}
|
|
# SSA strategy applied to customizer-rendered manifests. Default Merge for
|
|
# safety (kustomize-controller will still force-transfer ownership on
|
|
# overlapping fields — Flux SSA conflict detection cannot catch this; the
|
|
# planned admission webhook on packages.cozystack.io is the enforcement
|
|
# path — but Merge avoids cleanup-side surprises). Set to Override only
|
|
# once admins are confident no chart-managed field will be claimed by
|
|
# their manifests.
|
|
ssaStrategy: Merge
|
|
|
|
rbac:
|
|
# Namespaces in which the customizer SA is bound to cluster-admin (full
|
|
# mutate within these namespaces). cozy-customizer is the chart-created
|
|
# default — the admin's own playground for bring-your-own HelmReleases,
|
|
# NetworkPolicies, etc.
|
|
ownedNamespaces:
|
|
- cozy-customizer
|