mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-06 03:57:52 +09:00
Aleksei Sviridkin
69247ba80c
Add the securitygroup-controller Helm package (Deployment, ServiceAccount, ClusterRole and binding, image build) and register it as a default system package so it ships with the platform. The ClusterRole grants cluster-wide pod patch — the controller stamps the SecurityGroup membership label on managed-app pods across dynamically-created tenant namespaces, so the grant cannot be namespace-scoped — plus read and finalizer patch on the backing CiliumNetworkPolicies, and leader-election leases. Tenants gain no new permissions; the membership label is written exclusively by this platform controller. helm-unittest pins the pod-patch and ciliumnetworkpolicies grants so a dropped verb fails the suite rather than silently failing closed at runtime. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
23 lines
526 B
YAML
23 lines
526 B
YAML
---
|
|
apiVersion: cozystack.io/v1alpha1
|
|
kind: PackageSource
|
|
metadata:
|
|
name: cozystack.securitygroup-controller
|
|
spec:
|
|
sourceRef:
|
|
kind: OCIRepository
|
|
name: cozystack-packages
|
|
namespace: cozy-system
|
|
path: /
|
|
variants:
|
|
- name: default
|
|
dependsOn:
|
|
- cozystack.networking
|
|
components:
|
|
- name: securitygroup-controller
|
|
path: system/securitygroup-controller
|
|
install:
|
|
privileged: true
|
|
namespace: cozy-securitygroup-controller
|
|
releaseName: securitygroup-controller
|