Aleksei Sviridkin d1c6a24bf4 test(nats): state precisely what a label stamp on a key-bearing Secret reaches ...

The comment claimed a visibility label on either cert-manager Certificate
would hand its private key to every tenant subject. It would not, today:
tenantsecrets serves only what the lineage webhook marked
tenantresource=true, and lineage resolves through ownerReferences or the
Flux helm label, neither of which a cert-manager Secret carries while
enableCertificateOwnerRef stays false.

The assertions stay -- they become load-bearing as soon as either gate
moves, and one of them is not this chart's to hold.

Signed-off-by: Aleksei Sviridkin <3811295@gmail.com>

2026-08-15 22:40:58 +03:00

..

certmanager_test.yaml

test(nats): state precisely what a label stamp on a key-bearing Secret reaches

2026-08-15 22:40:58 +03:00

nats_tls_test.yaml

fix(nats): force cluster route useFQDN when TLS enabled to match cert SAN wildcard

2026-05-27 11:19:43 +03:00

tenant_projection_test.yaml

test(nats): pin the trust-anchor sentinel to a single projection entry

2026-08-15 22:40:58 +03:00