mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 18:47:04 +09:00
Myasnikov Daniil
51f0fc08ae
Phase 2 of #2787: the platform side of tenant auto-unseal. A tenant OpenBAO cannot be handed a transit seal until something has created its key on the central instance and given its pods a way to authenticate, and that has to be reactive because instances come and go with tenants. The reconciler watches inner OpenBAO HelmReleases carrying apps.cozystack.io/transit-unseal and, per instance, ensures a transit key, an unseal policy scoped to that key, and a Kubernetes-auth role bound to the instance's server ServiceAccount. It then publishes the central CA as the <name>-transit-ca ConfigMap, which is a public certificate rather than a Secret. No token is minted or delivered. The instance exchanges its own projected ServiceAccount token for a transit token at every boot, so there is no long-lived credential in the tenant namespace to store, rotate or leak. The CA ConfigMap is owner-referenced to the HelmRelease, so it is garbage-collected with the instance. Nothing emits that label yet, so this is inert until the tenant chart grows a transit seal. It ships here because it is the platform half of the feature and belongs with the central instance rather than with the chart that consumes it. Refs #2787 Assisted-By: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>