mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Aleksei Sviridkin
ebf2b2a08a
A qdrant release with TLS on mints a self-signed CA whose Secret also holds the CA private key, so tenants had no way to verify the server without being handed a signing key. The chart now declares a TenantProjection sentinel naming that Secret. The CA-extraction controller reads it and publishes a key-free copy, ca.crt only, as <release>.tenant-ca; the qdrant ResourceDefinition selects that projection by label so it surfaces in the tenant's secret list. No key-bearing Secret gains a tenant-visible label. The sentinel is gated on the chart's TLS condition. Unlike engines whose operator mints a CA unconditionally, qdrant only has one while TLS is enabled, and an ungated sentinel would sit Ready=False/SourceNotFound on every plaintext release. Tests pin the two invariants that fail silently: the sentinel carries no ownerReferences, so the lineage walk falls through to the Flux release label, and neither key-bearing Certificate stamps a tenant-visible label on its Secret. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>