mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-30 16:47:20 +09:00
Timofei Larkin
8b574fb2dc
Two optional system packages bring in IP addresses as a first-class resource (cozystack/community#35): cozystack.address-controller, the class-agnostic core (IPAddressClass / IPAddress / IPAddressClaim, local.sdn.cozystack.io), and cozystack.metallb-iad, the driver implementing the contract for addresses announced by MetalLB. Both follow the umbrella shape: the upstream chart is vendored under charts/ from cozystack/address-controller and cozystack/metallb-iad, and what belongs to Cozystack rather than to a generic Kubernetes controller lives in the wrapper. Neither project publishes a chart artifact, and the org has built no release image of either yet, so each `update` target clones at the main commit whose build the wrapper's image pin names; chart and controller come from the same source. The wrapper carries the tenant grant. The upstream chart is Cozystack- agnostic and grants only the controller, so nothing there lets a tenant use the API it serves; cozy:addresses, cozy:addresses:view and cozy:addresses:admin aggregate into the platform's base tenant roles, which resolve by label, so the grant is present exactly while the package is. Only IPAddressClaim is granted: the other two kinds are cluster-scoped and cozy:tenant* reaches a tenant through a per-namespace RoleBinding, so a rule for either could never be consulted. The wrapper also pins both controller images by digest to the main-<sha> builds of the vendored commits, which the charts' own floating :main defaults would otherwise leave free to move underneath a cluster, and points the driver at cozy-metallb instead of the upstream default metallb-system. The driver's PackageSource declares dependsOn on the core, whose CRDs it needs, and on cozystack.metallb. The core installs with upgradeCRDs: CreateReplace since its CRDs are v1alpha1 and still evolving. Neither package is in the postgres E2E install closure, so both join the selective-install fixture's disable list. Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>