Aleksei Sviridkin 6322b49d74 test(qdrant): pin the tenant-visible Secret surface on both layers ...

Two objects decide which Secrets a tenant may read: the dashboard Role
with its binding, and the ResourceDefinition. Adding qdrant-<name>-ca
to either hands every tenant subject the CA private key — enough to
issue certificates for anything — and nothing failed when that
happened.

Each layer is pinned whole rather than checked for known-bad names,
because the ways this breaks add no name to notice: a rule granting
secrets with no resourceNames restricts nothing, and a label selector
can reach a key-bearing Secret while every name stays correct. The
files carry the reasoning, including what the pinning does not settle.

The ResourceDefinition is checked against the rendered chart rather
than the file on disk, since the template globs a directory and a
second file there ships the same way.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-08-09 21:44:07 +03:00

..

e2e-apps

test(e2e): poll users-Job DESIRED_USERS_JSON for target email, not just Job existence

2026-07-15 15:31:45 +03:00

e2e-chainsaw

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

lib

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

testdata

test(release): scope the trim pin to the parse step, fix two stale references

2026-07-27 14:03:49 +05:00

admin-kubeconfig-invariant.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

bats-no-exit-trap.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

boilerplate.go.txt

Introduce cozystack-controller (#560)

2025-01-09 12:24:51 +01:00

build-matrix_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

build-matrix.sh

fix(build): force full image rebuild on root Go source changes

2026-06-25 10:21:05 +05:00

buildkitd.toml

ci(build): route PR base-image pulls through mirror.gcr.io

2026-06-24 23:17:25 +03:00

capture-dataplane.bats

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

capture-previous-logs.bats

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cdi_golden_image_create.sh

[vm-default-images] Added new optional package

2026-04-14 19:59:19 +05:00

changelog-preserve.sh

ci(release): execute the release-changelog logic in tests, not just grep it

2026-07-24 11:34:17 +05:00

check-applicationdefinition-crd-ordering.bats

fix(platform): make *-rd sources depend on cozystack-engine

2026-06-24 22:43:56 +03:00

check-gpu-operator-variants.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-gpu-recording-rules.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.sh

fix(hack): wrap du in 'timeout 5s' to prevent preflight stall

2026-04-11 17:07:35 +03:00

check-kafka-rd-schema.bats

test(kafka): assert scalar boolean tls.enabled type in rd-schema check

2026-05-27 16:21:46 +03:00

check-kafka-rd-secrets.bats

test(kafka): add cluster-ca-cert checks to kafka-rd secrets bats test

2026-05-27 11:16:41 +03:00

check-migrations-target.sh

refactor(hack): replace ls|grep with pure-bash glob (shellcheck SC2010)

2026-07-14 13:08:54 +03:00

check-optional-repos.sh

Rename cozypkg to cozyhr

2025-12-25 16:54:22 +01:00

check-qdrant-rd-secrets.bats

test(qdrant): pin the tenant-visible Secret surface on both layers

2026-08-09 21:44:07 +03:00

check-rd-presets.sh

fix(hack): tighten resourcesPreset enum check

2026-05-12 03:04:48 +03:00

cilium-leak-healer_test.bats

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

cni-plugins-staging-contract.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

collect-images.sh

[dx] Refactor collect-images functionality

2025-07-03 14:26:56 +03:00

common-envs_test.bats

test(hack): cover the default (non-export) build path (#3262)

2026-07-29 17:47:28 +05:00

common-envs.mk

fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)

2026-07-29 17:47:28 +05:00

cozyreport-summary.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cozyreport-talos.bats

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozyreport.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

cozyreport.sh

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozystack-version-stamp.bats

test(platform): enforce go-forward version stamps route through the helper

2026-06-24 15:32:52 +03:00

cozytest-capture-gate.bats

fix(tests): report a data-plane capture cut short by its backstop

2026-08-08 17:08:54 +03:00

cozytest.sh

docs(tests): correct five stale claims in the e2e capture tooling (#3662)

2026-08-09 04:08:35 +03:00

dcgm-default-counters.csv

fix(gpu-operator): pin upstream behavior changes; correct DLS licensing example

2026-04-30 14:52:56 +03:00

download-dashboards.sh

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

downstream-trigger-map.bats

docs(agents): add downstream repository checklist to the PR template

2026-07-14 17:07:47 +03:00

e2e-capture-dataplane.sh

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

e2e-capture-previous-logs.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

e2e-cilium-endpoint-leak-healer.sh

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-cilium-leak-healer.yaml

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-ghcr-mirror.yaml

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

e2e-install-cozystack.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

e2e-post-install-prep.sh

fix(e2e): gate LINSTOR node-list probe on a ready controller endpoint

2026-07-09 00:44:34 +03:00

e2e-prepare-cluster.bats

fix(e2e): disable guest fsync on ephemeral CI VM disks

2026-07-28 17:48:40 +02:00

e2e-prepull-images.sh

test(e2e): pre-pull platform images via staged-busybox DaemonSet

2026-05-25 11:56:30 +05:00

e2e-talos-image-cache.yaml

test(e2e): make the talos image cache reachable by tenant workers (#3254)

2026-07-09 18:21:07 +05:00

e2e-test-openapi.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

etcd-probe_test.bats

test(etcd): stop losing the metrics probe's output to the attach race

2026-07-19 20:16:01 +03:00

gate-concurrency-contract.bats

test(ci): require the discarded-label guard per job, not just agreement

2026-08-08 02:26:19 +03:00

ghcr-mirror_test.bats

fix(e2e): harden the ghcr.io mirror resolver and bound its diagnostics

2026-08-09 16:17:33 +03:00

helm-unit-tests.bats

test(helm): sweep packages/tests so the library suite stands on its own

2026-08-08 16:46:36 +03:00

helm-unit-tests.sh

test(helm): sweep packages/tests so the library suite stands on its own

2026-08-08 16:46:36 +03:00

image-pin-consistency.bats

fix(backupstrategy-controller): give chBackupClientImage a producer

2026-07-21 23:15:46 +05:00

kubernetes-md0-migration.bats

test(platform): cover migration 47 fail-closed contract

2026-06-30 12:08:18 +05:00

kubernetes-pre-delete-hook.bats

fix(apps/kubernetes): report the pre-delete cleanup outcome honestly

2026-08-07 06:49:56 +03:00

md-no-hardwrap.bats

feat(agents): add md-no-hardwrap hook enforcing the prose rule

2026-07-14 14:37:52 +03:00

migrate-to-version-1.0.sh

Fixed packages name conversion in migration script

2026-03-03 19:10:39 +05:00

migration-50-etcd-adopt.bats

feat(platform): make the etcd-adoption skip-backup hatch reachable

2026-07-20 11:29:09 +05:00

migration-seaweedfs-db-adopt.bats

test(seaweedfs): run the db-adopt migrations in the shell they ship with

2026-07-20 15:40:49 +05:00

monitoring-pvc-backfill-migration.bats

test(monitoring): reproduce the real vmselect cache PVC name in the backfill test

2026-07-08 22:27:42 +03:00

multus-install-cni-plugins.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror.sh

fix(nightly): rewrite an image host that is the whole scalar value

2026-07-28 18:07:34 +02:00

overlay-main-images_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

overlay-main-images.sh

fix(ci): preserve a PR's own edits to non-rebuilt package image refs

2026-06-30 16:56:33 +03:00

package.mk

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

parse-rc-tag.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

pod-label-census_test.bats

fix(e2e): select catch pod logs by the nested release instance label

2026-08-05 16:46:50 +03:00

pre-checks.sh

Fix osx grep have no -P flag (#438)

2024-10-21 11:59:56 +02:00

promote-gate-contract.bats

fix(ci): grant rc-e2e the checks:write ceiling e2e-tag.yaml declares

2026-07-27 14:03:49 +05:00

promote-retag_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

promote-retag.sh

fix(release): prove a stable tag is absent before copying over it

2026-07-27 13:56:45 +05:00

promote-rewrite-tags_test.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

promote-rewrite-tags.sh

test(ci): make the image-ref guards see split-host and unparseable files

2026-07-21 21:08:15 +05:00

release-changelog-behaviour.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-changelog-contract.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-freeze-contract.bats

test(release): clean up the guard test's scratch dir without an EXIT trap

2026-08-08 21:02:20 +03:00

remediation-guard.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

run-kubernetes-drain_test.bats

test(e2e): fix post-merge seams the conflict markers missed

2026-07-08 18:06:22 +05:00

run-kubernetes-node-join_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-schedulable_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-serial-console_test.bats

test(e2e): capture the tenant worker guest serial console

2026-08-08 05:48:38 +03:00

run-kubernetes-talos-diagnostics_test.bats

test(hack): clean up the Talos diagnostics tests without an EXIT trap

2026-08-07 23:53:40 +03:00

run-kubernetes-talos-spec_test.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

seaweedfs-guard-parity.bats

fix(seaweedfs): stop the naming guard guessing which volume generation holds the data

2026-07-20 15:40:48 +05:00

seaweedfs-naming-audit.bats

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

seaweedfs-naming-audit.sh

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

select-changelog-source.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

select-e2e_test.bats

fix(ci): close the silent-green gaps in e2e selection and the helm unit sweep (#3670)

2026-08-08 20:47:06 +03:00

select-e2e.sh

fix(ci): treat a disabled chainsaw suite as inert in test selection

2026-08-08 16:31:39 +03:00

select-install_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

select-install.sh

test(sdn): pin the fail-closed suite-mapping contract in validate

2026-07-17 14:41:13 +04:00

talos-image-cache_test.bats

test(e2e): pin that an unanswered mirror lookup is not a mirror absence

2026-08-09 13:31:54 +03:00

talos-reconcile-heredoc_test.bats

fix(kubernetes): escape tenant values in the worker reconcile heredoc

2026-08-09 16:17:26 +03:00

tenant-pre-delete-hook.bats

fix(tenant): bound the pre-delete cleanup waits and the hook Job

2026-08-07 14:38:06 +03:00

update-codegen.sh

feat(cozystack-controller): extract application CA into a key-free tenant Secret

2026-07-21 23:59:48 +03:00

update-crd.sh

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

upload-assets.sh

[docs] Added openapi generation tool

2026-03-25 15:57:25 +05:00

upload-releasenotes.sh

Add AI-agent for changelogs generation

2025-11-26 20:18:43 +01:00

validate-changelog.sh

ci(release): fix second-round review findings

2026-07-24 11:34:17 +05:00