Aleksei Sviridkin a55dc5ff19 feat(mariadb): name the dangerous Secrets in the ApplicationDefinition exclude ...

The include selector matches by label and carries no name constraint, so
any Secret of this instance that acquires the tenant-ca label is promoted
to the tenant with its data copied verbatim. The label on the source is
policy-guarded; the one on the destination is not. Exclude is evaluated
first and short-circuits, so naming the dangerous Secrets closes the part
of that gap we can enumerate.

Listed by group with the reason each is dangerous: the private keys from
both issuers, the internal database credentials, the backup S3 keys and
restic password, and the registry pull secret.

The guarantee is only as wide as the list. Matching is by exact name with
no globs, so a Secret added by a future operator version, or one created
transiently during a rotation, is not covered — the protection that holds
in general is still that only the extraction controller writes the label.
mariadb-operator has no rotation-snapshot Secret of the kind that makes
this worse elsewhere; its Secret names are fixed.

The existing guard against a key-bearing name is rescoped to
secrets.include while here, since such a name under exclude is the
backstop working rather than a leak.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-03 01:38:47 +03:00

..

e2e-apps

test(valkey): port e2e to chainsaw suite

2026-09-01 11:44:07 +04:00

e2e-chainsaw

feat(valkey): add managed Valkey service (#3380)

2026-09-02 18:18:42 +04:00

lib

docs(release): name all four sourcers of the image-ref enumeration

2026-08-14 18:37:59 +05:00

testdata

fix(migrations): make the unadopted-pools record publish best-effort

2026-08-25 12:38:28 +03:00

admin-kubeconfig-invariant.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

app-cleanup-hooks_test.bats

fix(apps): make the post-delete cleanup hooks report failure

2026-08-12 18:43:02 +03:00

bats-no-exit-trap.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

boilerplate.go.txt

Introduce cozystack-controller (#560)

2025-01-09 12:24:51 +01:00

build-matrix_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

build-matrix.sh

fix(build): force full image rebuild on root Go source changes

2026-06-25 10:21:05 +05:00

buildkitd.toml

ci(build): route PR base-image pulls through mirror.gcr.io

2026-06-24 23:17:25 +03:00

capture-dataplane.bats

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

capture-previous-logs.bats

fix(e2e): preserve previous-log cap slots

2026-08-28 15:29:29 +05:00

cdi_golden_image_create.sh

[vm-default-images] Added new optional package

2026-04-14 19:59:19 +05:00

changelog-preserve.sh

ci(release): execute the release-changelog logic in tests, not just grep it

2026-07-24 11:34:17 +05:00

check-applicationdefinition-crd-ordering.bats

fix(platform): make *-rd sources depend on cozystack-engine

2026-06-24 22:43:56 +03:00

check-gpu-operator-variants.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-gpu-recording-rules.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

check-host-runtime.sh

fix(hack): wrap du in 'timeout 5s' to prevent preflight stall

2026-04-11 17:07:35 +03:00

check-kafka-rd-schema.bats

test(kafka): assert scalar boolean tls.enabled type in rd-schema check

2026-05-27 16:21:46 +03:00

check-kafka-rd-secrets.bats

test(kafka): add cluster-ca-cert checks to kafka-rd secrets bats test

2026-05-27 11:16:41 +03:00

check-mariadb-rd-secrets.bats

feat(mariadb): name the dangerous Secrets in the ApplicationDefinition exclude

2026-09-03 01:38:47 +03:00

check-migrations-target.sh

refactor(hack): replace ls|grep with pure-bash glob (shellcheck SC2010)

2026-07-14 13:08:54 +03:00

check-mongodb-rd-secrets.bats

fix(mongodb): declare the trust anchor with a TenantProjection

2026-09-01 11:20:32 +03:00

check-nats-rd-secrets.bats

test(nats): compare both tenant grant surfaces against their whole form

2026-08-15 22:40:58 +03:00

check-optional-repos.sh

Rename cozypkg to cozyhr

2025-12-25 16:54:22 +01:00

check-qdrant-rd-secrets.bats

test(qdrant): pin the tenant-visible Secret surface on both layers

2026-08-09 21:44:07 +03:00

check-rd-presets.sh

fix(hack): tighten resourcesPreset enum check

2026-05-12 03:04:48 +03:00

cilium-leak-healer_test.bats

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

clickhouse-update-versions_test.bats

fix(clickhouse): fetch tags via skopeo and fail closed on a missing pin

2026-08-26 00:15:22 +03:00

cni-plugins-staging-contract.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

codeowners-invariant.bats

test(codeowners): guard the coverage invariant with a unit check

2026-08-10 10:30:30 +02:00

collect-images.sh

[dx] Refactor collect-images functionality

2025-07-03 14:26:56 +03:00

common-envs_test.bats

test(hack): cover the default (non-export) build path (#3262)

2026-07-29 17:47:28 +05:00

common-envs.mk

fix(ci): gate release tags/pushes off under OCI_EXPORT_DIR (defense-in-depth)

2026-07-29 17:47:28 +05:00

cozyreport-summary.sh

fix(e2e): collect logs for unready pods and record truncated captures

2026-08-05 17:37:04 +03:00

cozyreport-talos.bats

fix(e2e): bound every remaining read in the report collector

2026-08-07 14:38:29 +03:00

cozyreport.bats

test(e2e): capture CertificateSigningRequests in cozyreport

2026-08-20 17:39:36 +03:00

cozyreport.sh

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

cozystack-controller-secret-rbac.bats

test(cozystack-controller): guard the Secret grant by effective permission

2026-08-12 18:37:09 +03:00

cozystack-version-stamp.bats

test(platform): enforce go-forward version stamps route through the helper

2026-06-24 15:32:52 +03:00

cozytest-capture-gate.bats

fix(tests): report a data-plane capture cut short by its backstop

2026-08-08 17:08:54 +03:00

cozytest-trace-switch.bats

test(tests): keep trace switch suite ASCII-only

2026-08-28 15:31:22 +05:00

cozytest.sh

test(tests): keep trace switch suite ASCII-only

2026-08-28 15:31:22 +05:00

dcgm-default-counters.csv

fix(gpu-operator): pin upstream behavior changes; correct DLS licensing example

2026-04-30 14:52:56 +03:00

download-dashboards.sh

Add monitoring for NATs

2026-02-17 22:54:12 +01:00

downstream-trigger-map.bats

docs(agents): add downstream repository checklist to the PR template

2026-07-14 17:07:47 +03:00

e2e-capture-dataplane.sh

test(e2e): capture host-netns address attribution and a healthy-pod reference

2026-08-09 14:42:19 +03:00

e2e-capture-previous-logs.sh

fix(e2e): preserve previous-log cap slots

2026-08-28 15:29:29 +05:00

e2e-cilium-endpoint-leak-healer.sh

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

e2e-cilium-leak-healer.yaml

fix(e2e): skip cilium-agent restart for the reserved:ingress IP variant

2026-06-30 19:40:47 +03:00

e2e-ghcr-mirror.yaml

test(e2e): warm the ghcr.io mirror before the tenant suites need it

2026-08-14 11:08:49 +03:00

e2e-install-cozystack.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

e2e-node-join-soft-red.sh

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

e2e-post-install-prep.sh

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

e2e-prepare-cluster.bats

Merge branch 'main' into feat/kubernetes-nodes-phase2b

2026-08-19 13:14:11 +03:00

e2e-prepull-images.sh

test(e2e): pre-pull platform images via staged-busybox DaemonSet

2026-05-25 11:56:30 +05:00

e2e-runner-identity.sh

test(e2e): record the runner's SVM feature flags in the identity capture

2026-08-23 19:38:49 +05:00

e2e-talos-image-cache.yaml

test(e2e): make the talos image cache reachable by tenant workers (#3254)

2026-07-09 18:21:07 +05:00

e2e-test-openapi.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

etcd-probe_test.bats

test(etcd): stop losing the metrics probe's output to the attach race

2026-07-19 20:16:01 +03:00

gate-concurrency-contract.bats

fix(ci): put every label guard in lockstep, forks included

2026-08-14 18:37:57 +05:00

ghcr-mirror_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

helm-unit-tests.bats

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

helm-unit-tests.sh

fix(hack): fail when a chart runs no Helm unit test suites

2026-08-12 18:45:22 +03:00

image-pin-consistency.bats

fix(backupstrategy-controller): give chBackupClientImage a producer

2026-07-21 23:15:46 +05:00

issue-triage-contract.bats

feat(ci): auto-apply triage labels to issues

2026-08-12 16:35:36 +03:00

kubectl-wait-retry_test.bats

test(kubernetes): make kubectl_wait_retry set -e safe

2026-07-31 16:11:08 +03:00

kubernetes-md0-migration.bats

test(platform): cover migration 47 fail-closed contract

2026-06-30 12:08:18 +05:00

kubernetes-nodes-unpin-hook.bats

fix(kubernetes-nodes): unpin absence via --ignore-not-found

2026-07-25 02:07:43 +03:00

kubernetes-pre-delete-hook.bats

fix(apps/kubernetes): report the pre-delete cleanup outcome honestly

2026-08-07 06:49:56 +03:00

md-no-hardwrap.bats

feat(agents): add md-no-hardwrap hook enforcing the prose rule

2026-07-14 14:37:52 +03:00

migrate-to-version-1.0.sh

Fixed packages name conversion in migration script

2026-03-03 19:10:39 +05:00

migration-50-etcd-adopt.bats

feat(platform): make the etcd-adoption skip-backup hatch reachable

2026-07-20 11:29:09 +05:00

migration-54-redis-adopt.bats

test(migrations): cover migration 54 redis adopt (label+pin, CRD probe fail-closed)

2026-08-19 10:15:59 +02:00

migration-55-fluxcd-orphan.bats

feat(platform): orphan tenant FluxCD HelmReleases on upgrade

2026-08-20 13:37:09 +03:00

migration-56-adopt-path.bats

fix(migrations): record foreign-owner skips, harden record_skip, scope restamp to kubernetes- names

2026-08-25 13:28:58 +03:00

migration-56-adopt-values.bats

fix(migrations): discover pre-chartRef parents via inline spec.chart in the restamp

2026-08-25 13:50:14 +03:00

migration-seaweedfs-db-adopt.bats

test(seaweedfs): run the db-adopt migrations in the shell they ship with

2026-07-20 15:40:49 +05:00

monitoring-pvc-backfill-migration.bats

test(monitoring): reproduce the real vmselect cache PVC name in the backfill test

2026-07-08 22:27:42 +03:00

multus-install-cni-plugins.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

nightly-mirror.sh

fix(nightly): rewrite an image host that is the whole scalar value

2026-07-28 18:07:34 +02:00

node-join-soft-red_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

overlay-main-images_test.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

overlay-main-images.sh

fix(ci): preserve a PR's own edits to non-rebuilt package image refs

2026-06-30 16:56:33 +03:00

package-mk-phony.bats

test(hack): cover the .PHONY declarations this tree relies on

2026-08-14 01:25:34 +03:00

package.mk

fix(hack): declare the shared package targets phony

2026-08-12 18:42:58 +03:00

parse-rc-tag.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

pod-label-census_test.bats

fix(e2e): select catch pod logs by the nested release instance label

2026-08-05 16:46:50 +03:00

post-install-prep.bats

fix(e2e): budget each linstor wait separately in post-install-prep

2026-08-10 00:10:53 +03:00

pre-checks.sh

Fix osx grep have no -P flag (#438)

2024-10-21 11:59:56 +02:00

promote-gate-contract.bats

docs(hack): fix a wrong claim about grep-error propagation in two contract tests

2026-08-10 12:08:02 +03:00

promote-packages-artifact_test.bats

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-artifact.sh

fix(release): preflight the rc tree's own pin before publishing

2026-08-14 18:37:58 +05:00

promote-packages-contract.bats

test(release): pin every requiredBaseFiles entry, not just the list

2026-08-14 18:37:59 +05:00

promote-retag_test.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

promote-retag.sh

fix(ingress-nginx): pull the protobuf-exporter from the project namespace

2026-08-12 18:16:18 +02:00

promote-rewrite-tags_test.bats

feat(multus)!: stage reference CNI plugins from the multus image

2026-08-05 14:19:47 +03:00

promote-rewrite-tags.sh

test(ci): make the image-ref guards see split-host and unparseable files

2026-07-21 21:08:15 +05:00

promotion-retention-contract.bats

fix(release): stop a failed org package listing from exiting green

2026-08-14 18:37:59 +05:00

release-changelog-behaviour.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-changelog-contract.bats

test(hack): let each bats file declare the EXIT traps it still holds

2026-08-07 23:53:40 +03:00

release-freeze-contract.bats

test(ci): extend the backport label contract to both spellings

2026-08-27 13:08:16 +05:00

remediation-guard.bats

test(hack): clean up bats temp dirs without EXIT traps

2026-08-05 16:03:57 +03:00

run-kubernetes-block-io_test.bats

test(e2e): capture worker block IO and volume state on node-join failure

2026-08-17 14:22:09 +03:00

run-kubernetes-cpu-throttle_test.bats

test(e2e): anchor the phase-warning guard on its own unique phrase

2026-08-18 15:44:13 +03:00

run-kubernetes-drain_test.bats

test(e2e): fix post-merge seams the conflict markers missed

2026-07-08 18:06:22 +05:00

run-kubernetes-kvm-exits_test.bats

test(e2e): measure the sandbox kernel KVM exit counters across the node-join wait

2026-08-17 14:18:21 +03:00

run-kubernetes-network-counters_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-node-join_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-runner-canary_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-runner-cpu_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-sandbox-cpu-time_test.bats

test(e2e): measure tenant worker CPU as a rate, and the sandbox nodes under it

2026-08-15 10:19:19 +03:00

run-kubernetes-schedulable_test.bats

fix(e2e): bound the tenant failure diagnostics per read and as a phase

2026-08-09 02:51:06 +03:00

run-kubernetes-serial-console_test.bats

feat(kubernetes)!: manage worker pools as KubernetesNodes, adopt on upgrade (Phase 2, breaking) (#3315)

2026-08-26 12:06:18 +04:00

run-kubernetes-talos-diagnostics_test.bats

test(e2e): stop blocking merges on the tenant node-join deadline

2026-08-21 12:52:42 +03:00

run-kubernetes-talos-spec_test.bats

fix(e2e): wire the ghcr.io mirror into the tenant install and node-join flow

2026-08-09 16:17:44 +03:00

run-kubernetes-thread-cpu_test.bats

test(e2e): split the tenant worker CPU time across QEMU threads

2026-08-16 05:17:16 +03:00

runner-identity.bats

test(e2e): record the runner's SVM feature flags in the identity capture

2026-08-23 19:38:49 +05:00

sandbox-cidr-disjoint.bats

fix(e2e): stop the sandbox cluster CIDR overlapping the pod range

2026-08-11 02:31:27 +03:00

sandbox-runner-headroom.bats

fix(ci): give the nightly e2e runner headroom over its guest vCPUs

2026-08-15 02:41:19 +03:00

seaweedfs-guard-parity.bats

fix(seaweedfs): stop the naming guard guessing which volume generation holds the data

2026-07-20 15:40:48 +05:00

seaweedfs-naming-audit.bats

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

seaweedfs-naming-audit.sh

fix(seaweedfs): read the chart name first-match, fail the fake on unmodelled calls

2026-07-27 13:52:59 +05:00

select-changelog-source.sh

ci(release): dispatch changelog generation at rc time

2026-07-24 18:16:16 +05:00

select-e2e_test.bats

fix(ci): correct two reachability defects in the selection graph

2026-08-16 10:44:44 +05:00

select-e2e.sh

fix(ci): correct two reachability defects in the selection graph

2026-08-16 10:44:44 +05:00

select-install_test.bats

fix(platform): make etcd-application depend on etcd-operator

2026-08-15 17:58:07 +05:00

select-install.sh

test(e2e): fold the clickhouse backup Tests into the app's own suite

2026-07-30 16:04:03 +04:00

talos-image-cache_test.bats

test(e2e): pin that an unanswered mirror lookup is not a mirror absence

2026-08-09 13:31:54 +03:00

talos-reconcile-heredoc_test.bats

test(e2e): drop the parent-chart heredoc cases removed by the Phase 2 split

2026-08-10 23:24:11 +03:00

tenant-pre-delete-hook.bats

fix(tenant): bound the pre-delete cleanup waits and the hook Job

2026-08-07 14:38:06 +03:00

update-codegen.sh

feat(cozystack-controller): extract application CA into a key-free tenant Secret

2026-07-21 23:59:48 +03:00

update-crd.sh

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

upload-assets.sh

[docs] Added openapi generation tool

2026-03-25 15:57:25 +05:00

upload-releasenotes.sh

Add AI-agent for changelogs generation

2025-11-26 20:18:43 +01:00

validate-changelog.sh

ci(release): fix second-round review findings

2026-07-24 11:34:17 +05:00

verify-promoted-packages_test.bats

test(release): cover the verifier's rc-reference scan guard

2026-08-14 18:37:59 +05:00

verify-promoted-packages.sh

docs(release): say what the gates actually guarantee

2026-08-14 18:37:58 +05:00