Aleksei Sviridkin 3b5af9dc55 fix(tenant): skip Cilium policies on isp-hosted without Cilium ...

The isp-hosted variants install no CNI of their own, so on a host
without Cilium the cilium.io/v2 kinds do not exist and the tenant
install fails, taking the root tenant and everything that depends on
cozystack-basics down with it.

The policies now render on isp-hosted only when the host serves both
Cilium policy kinds. On every other variant Cozystack installs Cilium
itself, so they keep rendering unconditionally: a CRD that is missing
at render time there fails the install loudly instead of leaving the
tenant without network isolation, because helm-controller does not
re-render a release when only API discovery changes.

On isp-hosted without Cilium the tenant gets no network isolation from
Cozystack; isolating tenants is then up to the host's CNI.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-02 12:06:54 +03:00

..

reports

docs(security): publish vulnerability reporting and a backlog reconciliation

2026-08-11 00:40:31 +05:00

incident-response.md

docs(security): fix the supported set at three lines and record that no backport rule exists

2026-08-10 21:55:37 +05:00

self-assessment.md

fix(tenant): skip Cilium policies on isp-hosted without Cilium

2026-10-02 12:06:54 +03:00

threat-model.md

fix(tenant): skip Cilium policies on isp-hosted without Cilium

2026-10-02 12:06:54 +03:00