Ivan Okhotnikov b85cefc3e2 fix(apps/kubernetes): extend --oidc-* guard to catch --authentication-config too ...

Same class of upgrade regression: a customer who wired their own
structured AuthenticationConfiguration by hand via
`controlPlane.apiServer.extraArgs: [--authentication-config=...]`
would hit a duplicate-flag scenario the moment they toggle
`spec.oidc.mode` — kube-apiserver would receive two conflicting
--authentication-config= arguments and the last-wins behaviour is
undefined between apiserver versions.

Add a second render-time guard that fails when a legacy
--authentication-config= is present in the user-supplied extraArgs
AND spec.oidc.mode is not None, pointing at the CustomConfig
migration path (customConfig.config or customConfig.secretRef.name).

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

2026-07-06 09:25:07 +03:00

..

apps

fix(apps/kubernetes): extend --oidc-* guard to catch --authentication-config too

2026-07-06 09:25:07 +03:00

core

fix(vertical-pod-autoscaler): migrate admission-controller TLS to cert-manager to stop reconcile-driven ReplicaSet churn (#3178)

2026-07-04 22:48:00 +03:00

extra

fix(cozystack-basics): validate legacy Ingress hostnames against the tenant apex

2026-07-04 22:38:39 +03:00

library

fix(cozy-lib,harbor,mariadb): digest-pin cleanup-hook kubectl image and route it through cozy-lib.images-registry

2026-07-02 17:44:59 +03:00

system

fix(apps/kubernetes): render-fail when spec.oidc.mode collides with legacy --oidc-* extraArgs

2026-07-06 09:25:07 +03:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00