mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-03 02:27:01 +09:00
The cacert controller re-runs admission after a selector change by dropping managed-by-cozystack and keeping the other labels, so the UPDATE carries the "false" this webhook wrote on an earlier admission. Reading that as the chart's narrowing froze the old verdict: a projection, once revoked, could not be granted again. The chart's narrowing only matters on CREATE, since an existing Secret already carries managed-by-cozystack and skips the webhook. Assisted-by: LLM Signed-off-by: Timofei Larkin <lllamnyp@gmail.com>