Aleksei Sviridkin d7232831f4 feat(cozystack-controller): run the CA-extraction reconciler ...

Wire the reconciler into the platform controller manager and grant its
ServiceAccount the Secret verbs the projection needs: create/update/patch
to publish the trust anchor, and delete to withdraw it when an application
stops publishing one. Read was already covered by the catch-all rule, and
no tenant RBAC is widened.

Give the reconciler its own dedicated, scoped Secret cache rather than
narrowing the manager's shared cache. Only labelled CA sources are held in
that informer, so a cluster-wide Secret watch never caches every Secret,
and so every private key, in the cluster; the operator-owned name-driven
sources and the projections are read through the uncached API reader
instead. A private cache also keeps this scoping independent of any other
controller on the same manager that needs to scope Secrets differently.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:46 +03:00

..

rbac_test.yaml

feat(cozystack-controller): run the CA-extraction reconciler

2026-07-21 17:16:46 +03:00