Aleksei Sviridkin 5da3fab457 feat(api): declare where an application's CA lives ...

The trust-anchor contract is a label on the CA Secret, but two engines
cannot honour it. CloudNativePG builds its PKI Secrets without applying
spec.inheritedMetadata, so the chart's labels never reach <release>-ca,
and Percona Server for MongoDB exposes no secretTemplate at all and
reconciles an out-of-band patch away.

Add an optional ApplicationDefinition.spec.caCert declaring, per engine,
the name of the Secret its operator creates and the key inside it that
holds the certificate. Registering an engine is then data, not code. The
declaration only names an object the platform already reads; nothing a
tenant can read is widened by it, and a labelled Secret still takes
precedence where an engine can label its own output.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:46 +03:00

..

api-rules

fix(api): regenerate OpenAPI with code-generator v0.35.0

2026-07-16 16:45:17 +05:00

apps/v1alpha1

chore(postgres): sync generated types.go docstring for bootstrap.serverName

2026-07-16 21:44:41 +04:00

backups

fix(backups): migrate CNPG backups to the barman-cloud plugin

2026-07-16 21:44:41 +04:00

gateway/v1alpha1

feat(tenantgateway): add existingSecret cert mode for operator wildcard

2026-06-10 03:08:07 +03:00

v1alpha1

feat(api): declare where an application's CA lives

2026-07-21 17:16:46 +03:00

.gitattributes

[backups] Implement core backup Plan controller

2025-12-05 11:58:00 +03:00