Aleksei Sviridkin 9ea4a961ec fix(cacert): make the comments match the reconciler ...

Comments in the CA-extraction package described guards the code does
not have.

ManagedLabel: the anti-clobber decision is made by isOurProjection,
from the Secret type and an owner reference back to the sentinel, not
from the marker, which no decision keys on beyond the drift check.

managedByCozystackLabel: the reconciler does mutate it. It deletes the
label on a selectors-digest change, which is what hands the projection
back to the lineage webhook for a fresh verdict.

projectionSuffix: the projection name is kept clear of engine CA
Secrets by a dot, and a release name cannot carry one, but the suffix
an operator appends can and nothing validates it. A suffix ending in
".tenant-ca" is the only one that reaches a canonical name.

TestProjectionNameCannotCollideWithADotFreeEngineSuffix: both its doc
and its name claimed the property for any engine suffix while the loop
samples only dot-free ones, which is the same overstatement one file
over.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-03 21:35:01 +03:00

..

reconciler_test.go

fix(cacert): make the comments match the reconciler

2026-09-03 21:35:01 +03:00

reconciler.go

fix(cacert): make the comments match the reconciler

2026-09-03 21:35:01 +03:00