mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Andrei Kvapil
28985ed0a8
## What this PR does Fixes a race condition where multiple Packages sharing the same namespace could overwrite each other's PodSecurity Admission labels via Server-Side Apply. When two PackageSources deploy to the same namespace (e.g. `cozystack.linstor` and `cozystack.linstor-scheduler` both use `cozy-linstor`), each Package only knew about its own components. If a Package without `privileged: true` reconciled the namespace, SSA would remove the `pod-security.kubernetes.io/enforce=privileged` label set by the other Package. On Talos clusters (which default to `baseline` PodSecurity enforcement), this caused privileged pods like LINSTOR satellites to be rejected. The fix makes each Package check ALL PackageSources and their active Packages when reconciling a namespace. A namespace is set to `privileged` if ANY Package has a component with `privileged: true` in it. This ensures a consistent, holistic decision regardless of reconciliation order. ### Release note ```release-note [platform] Fixed namespace PodSecurity label race condition when multiple Packages share a namespace ```