mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 03:27:07 +09:00
Andrei Kvapil
3c108c3353
## Summary - Add a readonly `BucketAccessClass` to the seaweedfs COSI chart with `accessPolicy: "readonly"` parameter - Each bucket now automatically creates two sets of S3 credentials: readWrite (existing, for UI) and readonly - Update dashboard RBAC and ApplicationDefinition to expose the readonly credentials secret ## Test plan - [ ] Verify seaweedfs chart templates render both `BucketAccessClass` resources (readWrite and readonly) - [ ] Verify bucket app templates render `BucketClaim` + 2 `BucketAccess` (readWrite + readonly) - [ ] Deploy a bucket and confirm both credential secrets are created by COSI driver - [ ] Confirm readonly credentials can only read/list objects, not write/delete <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Introduced read-only bucket access capabilities. Users can now configure read-only permissions for bucket storage resources, complementing existing access control options. New read-only access classes and configurations provide enhanced security controls and finer-grained permission management. This enables improved data protection while maintaining flexibility for various access requirements across applications and storage infrastructure. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd