mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Ivan Okhotnikov
0f60f0703a
Kamaji's controller takes SSA field-ownership on `KamajiControlPlane.spec.deployment.extraVolumes` when it syncs the resource back from the TenantControlPlane, and Helm's subsequent apply (with the same field-manager but a manifest that omits the OIDC volume) then no longer removes it — the tenant apiserver Pod keeps an unmounted-but-declared `authentication-config` volume pointing at a Secret the chart already reaped. Harmless at runtime (the volume is not mounted after the extraVolumeMounts fix), but the CRD gets dirty and the operator wants zero leftovers. Fix: the OIDC bootstrap Job is now rendered for ALL modes (not only `System`/`CustomConfig`). When `mode=None` the Job takes the normalize path — a single `kubectl patch --type=merge` that replaces `spec.deployment.extraVolumes` with the chart baseline (talos-ca + talos-tls-cert). We verified end-to-end that `kubectl patch --type=merge` on this array REPLACES it deterministically (the earlier Helm patch didn't). For `mode=System`/`CustomConfig` the Job continues to apply per-user ClusterRoleBindings inside the tenant cluster, prune stale ones labelled by this release, and patch the pre-rendered `<release>-oidc-kubeconfig` Secret with a real kubeconfig. The Role gains `patch` on the specific `kamajicontrolplanes/<release>` so the normalize path has just enough privilege; nothing else new. The pre-delete cleanup Job stays conditional on `mode != None` — no CRBs to clean up when OIDC was never enabled. Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>