Ivan Okhotnikov c5295d8bad feat(apps/kubernetes): bootstrap Job applies per-user CRBs and writes OIDC kubeconfig Secret ...

Add a post-install,post-upgrade Helm-hook Job that reconciles the
operator-supplied `users[]` list into the tenant cluster:

  - For every entry, apply a ClusterRoleBinding labelled by the
    release (managed-by=cozystack-oidc, instance=<release>).
    `role: admin` maps to `cluster-admin`; `role: view` maps to
    `view`. The subject is the literal `email` value, matched
    against the issuer's `preferred_username` claim.
  - Prune any orphan CRBs with the same labels — removing a user
    from `users[]` revokes their kubectl access on the next loop.

For `mode: System` the same Job also writes
`<release>-oidc-kubeconfig` on the management cluster: a ready
kubeconfig with the per-cluster apiserver endpoint, the tenant CA
extracted from the Kamaji-issued admin kubeconfig, and a
`kubectl oidc-login` exec block keyed to the per-cluster client.

A pre-delete cleanup Job removes the labelled CRBs before the
control plane is torn down (best-effort: the CRBs disappear with
the tenant cluster anyway).

Pod is labelled `policy.cozystack.io/allow-to-apiserver: "true"`
so Cilium lets it reach the konnectivity tunnel.

ServiceAccount/Role/RoleBinding are minimum-privilege — only the
specific admin-kubeconfig and OIDC kubeconfig Secrets are listed.

Renders nothing for `mode: None`.

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

2026-07-06 09:25:07 +03:00

..

common.yaml

fix(kubernetes): default worker disk storageClass to the application storageClass

2026-07-01 00:56:29 +03:00

oidc-system.yaml

feat(apps/kubernetes): bootstrap Job applies per-user CRBs and writes OIDC kubeconfig Secret

2026-07-06 09:25:07 +03:00