Aleksei Sviridkin 8a6f4884cb fix(mariadb): publish the tenant CA anchor through a projection, not by name ...

The dashboard Role and the ApplicationDefinition granted the operator's
key-free mariadb-<name>-ca-bundle Secret directly by name. Every other
converged engine (mongodb, postgres, nats, qdrant) instead renders a
TenantProjection that lifts ca.crt into the canonical <release>.tenant-ca
object, reached through core.cozystack.io/tenantsecrets rather than a
per-Secret grant.

Add templates/tenant-projection.yaml sourcing from the operator's
ca-bundle, drop the name grant from the dashboard Role and from the
ApplicationDefinition's secrets.include (the existing tenant-ca
matchLabels selector now has something to match), and remove the
ApplicationDefinition's caCert field, which named a field the
ApplicationDefinition CRD does not define and would have rejected the
whole object under server-side apply.

Update the README and the pinned RBAC tests to the new tenant-ca name.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-03 01:38:53 +03:00

..

apps

fix(mariadb): publish the tenant CA anchor through a projection, not by name

2026-09-03 01:38:53 +03:00

core

fix(valkey): add cozystack-engine dependsOn edge to the PackageSource

2026-09-01 11:44:29 +04:00

extra

docs(etcd): note that affinity is not applied to existing members

2026-09-01 12:47:46 +03:00

library

fix(cozy-lib): convert micro and nano quantities instead of zero

2026-08-16 22:20:17 +03:00

system

fix(mariadb): publish the tenant CA anchor through a projection, not by name

2026-09-03 01:38:53 +03:00

tests/cozy-lib-tests

fix(cozy-lib): convert micro and nano quantities instead of zero

2026-08-16 22:20:17 +03:00