Arsolitt e6ffe10c47 feat(redis): consume CA-only secret for tenant trust in dashboard RBAC ...

The redis-operator now publishes an Opaque Secret holding only ca.crt
(no private key) via spec.tls.caCertSecretName. Point that field at
<release>-ca-cert and grant the dashboard Role get/list/watch on it so
tenants can verify the server without touching any private key.

Drop the dashboard grant on <release>-ca-tls: that cert-manager secret
holds the CA private key and must never be exposed to tenants. The leaf
secret <release>-tls is now granted only when authClients=yes, where
clients reuse it as their client identity.

Refresh the vendored RedisFailover CRD with the new caCertSecretName
field and update the helm-unittest RBAC cases for the new layout.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>

2026-09-02 17:56:05 +03:00

..

apps

feat(redis): consume CA-only secret for tenant trust in dashboard RBAC

2026-09-02 17:56:05 +03:00

core

fix(valkey): add cozystack-engine dependsOn edge to the PackageSource

2026-09-01 11:44:29 +04:00

extra

docs(etcd): note that affinity is not applied to existing members

2026-09-01 12:47:46 +03:00

library

fix(cozy-lib): convert micro and nano quantities instead of zero

2026-08-16 22:20:17 +03:00

system

feat(redis): constrain tls.authClients to enum at the values source

2026-09-02 17:56:05 +03:00

tests/cozy-lib-tests

fix(cozy-lib): convert micro and nano quantities instead of zero

2026-08-16 22:20:17 +03:00