Aleksei Sviridkin b41b6cce89 feat(controller): discover the CA source through a TenantProjection sentinel ...

Drive the CA-extraction reconciler off the namespaced TenantProjection
sentinel a chart renders, replacing the publish-ca-cert label leg and
the cluster-scoped spec.caCert declaration leg. The sentinel names the
source Secret and key; the projected trust anchor takes an owner
reference to the sentinel, so the lineage webhook resolves the tenant
through sentinel -> HelmRelease and garbage collection prunes the
projection when the chart stops rendering the sentinel.

The source Secret is watched as metadata only, so the informer holds no
private key material, and the one source actually read goes through the
uncached reader. The sentinel's Ready status makes a missing or
unpopulated source visible with kubectl instead of a silent requeue.

The write-path guard, canonical-name contract, adoption rules and
selectors-digest re-admission are unchanged.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:49 +03:00

..

main_test.go

feat(controller): discover the CA source through a TenantProjection sentinel

2026-07-21 17:16:49 +03:00

main.go

feat(controller): discover the CA source through a TenantProjection sentinel

2026-07-21 17:16:49 +03:00