mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-27 15:17:13 +09:00
Aleksei Sviridkin
c841c70866
The operator-provided wildcard MVP serves the root tenant only: the root ingress controller and Gateway read a TLS Secret from their own namespace. Child tenants run their own ingress controller / Gateway in a separate, default-deny namespace and cannot read that Secret cross-namespace. Add a controller that mirrors the operator wildcard Secret into every tenant namespace that owns a TLS termination point (its namespace.cozystack.io/ingress or .../gateway label equals its own name). The source is identified by name from the platform values channel (_cluster.wildcard-secret-name) with no extra operator input; replicas carry a managed-by label and refresh on rotation. An individual replica is removed when its namespace stops terminating TLS; every replica is torn down only on an explicit disable (clearing wildcard-secret-name). A missing or mistyped source, or a transiently-absent values channel, keeps existing replicas, so tenant TLS never drops on a transient gap. The controller's Secret cache is scoped to managed replicas and the values channel, not every cluster Secret. Only the platform controller's ServiceAccount gains Secret writes — no tenant RBAC is widened, and every consumer reads only its own-namespace copy. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
22 lines
749 B
Makefile
22 lines
749 B
Makefile
NAME=cozystack-controller
|
|
NAMESPACE=cozy-system
|
|
|
|
include ../../../hack/common-envs.mk
|
|
include ../../../hack/package.mk
|
|
|
|
test:
|
|
helm unittest .
|
|
|
|
image: image-cozystack-controller
|
|
|
|
image-cozystack-controller:
|
|
docker buildx build -f images/cozystack-controller/Dockerfile ../../.. \
|
|
$(call image-tags,cozystack-controller,v$(COZYSTACK_VERSION)) \
|
|
--build-arg VERSION=v$(COZYSTACK_VERSION) \
|
|
$(call cache-args,cozystack-controller) \
|
|
--metadata-file images/cozystack-controller.json \
|
|
$(BUILDX_ARGS)
|
|
IMAGE="$(REGISTRY)/cozystack-controller:$(IMAGE_TAG)@$$(yq e '."containerimage.digest"' images/cozystack-controller.json -o json -r)" \
|
|
yq -i '.cozystackController.image = strenv(IMAGE)' values.yaml
|
|
rm -f images/cozystack-controller.json
|