mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 08:07:33 +09:00
Aleksei Sviridkin
69247ba80c
Add the securitygroup-controller Helm package (Deployment, ServiceAccount, ClusterRole and binding, image build) and register it as a default system package so it ships with the platform. The ClusterRole grants cluster-wide pod patch — the controller stamps the SecurityGroup membership label on managed-app pods across dynamically-created tenant namespaces, so the grant cannot be namespace-scoped — plus read and finalizer patch on the backing CiliumNetworkPolicies, and leader-election leases. Tenants gain no new permissions; the membership label is written exclusively by this platform controller. helm-unittest pins the pod-patch and ciliumnetworkpolicies grants so a dropped verb fails the suite rather than silently failing closed at runtime. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
21 lines
765 B
Makefile
21 lines
765 B
Makefile
NAME=securitygroup-controller
|
|
NAMESPACE=cozy-securitygroup-controller
|
|
|
|
include ../../../hack/common-envs.mk
|
|
include ../../../hack/package.mk
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
image: image-securitygroup-controller
|
|
|
|
image-securitygroup-controller:
|
|
docker buildx build -f images/securitygroup-controller/Dockerfile ../../.. \
|
|
$(call image-tags,securitygroup-controller,v$(COZYSTACK_VERSION)) \
|
|
$(call cache-args,securitygroup-controller) \
|
|
--metadata-file images/securitygroup-controller.json \
|
|
$(BUILDX_ARGS)
|
|
IMAGE="$(REGISTRY)/securitygroup-controller:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/securitygroup-controller.json -o json -r)" \
|
|
yq -i '.securityGroupController.image = strenv(IMAGE)' values.yaml
|
|
rm -f images/securitygroup-controller.json
|