Ivan Okhotnikov 5d13c15d65 fix(apps/kubernetes): compile OIDC groups claim rule via dyn() so the tenant apiserver boots ...

The System-mode AuthenticationConfiguration rendered a claimValidationRule
ranging over claims.groups, which is statically typed `any` in the apiserver
CEL environment. The .exists() comprehension rejects a range of type any, so
the tenant kube-apiserver failed config compilation at startup and CrashLooped
— the control plane never booted and cluster teardown then hung the e2e
cleanup budget. Wrap the range in dyn() so CEL treats it as dynamic; the has()
guard still short-circuits when groups is absent and the gate semantics are
unchanged. Strengthen the oidc unit test to pin dyn() (mutation-verified).
Verified on a live tenant apiserver (v1.32).

Signed-off-by: Ivan Okhotnikov <xorokhotnikov@gmail.com>

2026-07-15 15:31:45 +03:00

..

apps

fix(apps/kubernetes): compile OIDC groups claim rule via dyn() so the tenant apiserver boots

2026-07-15 15:31:45 +03:00

core

chore(monitoring): sync PackageSource comment with removed Keycloak groups

2026-07-15 15:31:45 +03:00

extra

fix(monitoring): promote oidc.users[].role to required + regenerate schema

2026-07-15 15:31:45 +03:00

library

fix(cozy-lib,harbor,mariadb): digest-pin cleanup-hook kubectl image and route it through cozy-lib.images-registry

2026-07-02 17:44:59 +03:00

system

fix(monitoring): set groups_attribute_path=groups so allowed_groups actually works on Grafana v11.x

2026-07-15 15:31:45 +03:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00