The tenant read path was two grants on Secret names: the operator's
CA-only <release>-ca-cert in the dashboard Role, and the same name in the
ApplicationDefinition's include list. Replace both with the projection
the previous commit declares.
A name grant conveys whatever occupies the name. The operator holds
create and update on Secrets cluster-wide, so what sits at
<release>-ca-cert is the operator's choice rather than the platform's,
and RBAC has no key-level filter to catch it if that ever stops being
just ca.crt. <release>.tenant-ca is written only by the CA-extraction
controller, which copies one named key and refuses PEM private key
material outright. That is the difference between a name that happens to
hold a certificate today and provenance the platform vouches for, and it
is the reason postgres, mongodb, nats and qdrant all reach the tenant
this way — mongodb's operator publishes a CA Secret of its own too, and
that one is excluded rather than granted.
Also drop spec.caCert from the ApplicationDefinition. The
ApplicationDefinition CRD does not define that field and Flux applies
these server-side, so the apiserver rejects the whole object with "field
not declared in schema" and the redis-rd release never goes ready. It was
carried deliberately as a merge-order gate for a controller that reads
it; that controller landed as the TenantProjection reconciler, which
reads a sentinel in the app chart instead, so the gate has nothing left
to wait for.
hack/check-redis-rd-secrets.bats pins the whole rendered Secret surface
rather than probing for known-bad names, alongside the existing guards
for nats, qdrant and mongodb: an include with neither resourceNames nor
matchLabels restricts nothing, and a second matchLabels entry selecting
a label cert-manager also stamps on the key-bearing Secrets would grant
the CA private key while every name in the file stayed correct.
The connection example passes the generated password as well. Password
generation is on by default, so the command as printed connected and then
answered NOAUTH on the first real command.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin
d0cab491f3