mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 10:37:21 +09:00
Alexey Artamonov
a37f4129b1
Resolves the CodeRabbit review threads on #3381: - RBAC: the apps.cozystack.io rule granted patch on "*"; scope it to the four database kinds the adapters can target (postgreses, mariadbs, redises, mongodbs) so the controller cannot touch unrelated aggregated-API resources. - Metrics TLS: the VMServiceScrape used insecureSkipVerify. Serve metrics with the cert-manager serving cert (the one already mounted for the webhook) and verify it in the scrape against its CA, with serverName matching a cert SAN (no metrics-service DNS name needed, since the pod is reached by IP but TLS verifies serverName). - Quorum: the postgres values schema does not lower-bound maxSyncReplicas, so a negative value produced a quorum floor below 1 and silently disabled the floor guard. Report it as non-scalable (AbleToScale=False) and clamp QuorumFloor to a minimum of 1 defensively. - Backoff overflow: cap ConvergenceDeadlineSeconds at 24h in the API and clamp the base in backoffDuration so the 8x re-attempt ceiling cannot overflow a time.Duration. - README: qualify the Postgres/Redis validation claims (functionally validated on a live dev cluster, not load-tested at production scale). Regression tests: negative-maxSyncReplicas (non-scalable + clamped floor), backoffDuration no-overflow, and helm-unittest assertions for the least- privilege RBAC and the verified metrics TLS. CRD regenerated for the new maximum. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>