cozystack

0 Fork 0

mirror of https://github.com/cozystack/cozystack.git synced 2026-11-13 08:05:19 +09:00

Files

T

Arsolitt e6ffe10c47 feat(redis): consume CA-only secret for tenant trust in dashboard RBAC

The redis-operator now publishes an Opaque Secret holding only ca.crt
(no private key) via spec.tls.caCertSecretName. Point that field at
<release>-ca-cert and grant the dashboard Role get/list/watch on it so
tenants can verify the server without touching any private key.

Drop the dashboard grant on <release>-ca-tls: that cert-manager secret
holds the CA private key and must never be exposed to tenants. The leaf
secret <release>-tls is now granted only when authClients=yes, where
clients reuse it as their client identity.

Refresh the vendored RedisFailover CRD with the new caCertSecretName
field and update the helm-unittest RBAC cases for the new layout.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Arsolitt <arsolitt@gmail.com>

2026-09-02 17:56:05 +03:00

bucket

fix(bucket): drop no-op label-based order/challenge delete

2026-06-29 23:10:24 +03:00

clickhouse

fix(clickhouse): scheme the backup S3_ENDPOINT on the system-bucket flow (#3963 )

2026-08-28 15:05:14 +04:00

foundationdb

feat(apps): declare storageClass x-cozystack-options in data app values.yaml

2026-06-02 16:33:57 +03:00

harbor

fix(apps): make the post-delete cleanup hooks report failure

2026-08-12 18:43:02 +03:00

http-cache

fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM (#2654 )

2026-07-22 20:57:45 +03:00

kafka

test(apps): anchor index-addressed negative asserts to what they name

2026-08-07 15:35:43 +03:00

kubernetes

fix(kubernetes): make the worker-adoption guard remedy actionable

2026-08-25 12:28:47 +03:00

kubernetes-nodes

fix(computeplane): provision worker pools via kubernetes-nodes after Phase 2 split

2026-08-24 11:19:54 +03:00

mariadb

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

mongodb

docs(mongodb): name the trust anchor as the tenant sees it

2026-09-01 11:20:34 +03:00

nats

docs(nats): say that the trust anchor exists only while TLS is on

2026-08-15 22:40:59 +03:00

openbao

fix(openbao): garbage-collect the data PVC on delete (#3058 )

2026-06-25 18:24:09 +03:00

opensearch

test(apps): anchor index-addressed negative asserts to what they name

2026-08-07 15:35:43 +03:00

postgres

fix(postgres): let in-place restore re-bootstrap instead of wedging

2026-08-25 17:31:53 +04:00

qdrant

feat(qdrant): publish ca.crt-only trust anchor to tenants (#3341 )

2026-09-01 13:10:37 +04:00

rabbitmq

feat(apps): declare storageClass x-cozystack-options in data app values.yaml

2026-06-02 16:33:57 +03:00

redis

feat(redis): consume CA-only secret for tenant trust in dashboard RBAC

2026-09-02 17:56:05 +03:00

tcp-balancer

docs(apps): point seven app README preset tables at canonical docs

2026-05-12 03:08:52 +03:00

tenant

test(tenant): anchor the operator-gate absence and refresh a spent reason

2026-08-12 18:43:08 +03:00

valkey

fix(valkey): label RedisFailover with operator-group so it is reconciled

2026-09-01 13:22:29 +04:00

vm-disk

fix(hooks): run the refreshed alpine/k8s kubectl hooks non-root

2026-06-22 21:26:42 +03:00

vm-instance

fix(hooks): run the refreshed alpine/k8s kubectl hooks non-root

2026-06-22 21:26:42 +03:00

vpc

[docs] Update cozyvalues-gen

2026-03-25 15:59:22 +05:00

vpn

fix(apps/vpn): remove invalid foo field from urls Secret

2026-07-13 23:32:24 +03:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

README.md

[clickhouse] add clickhouse keeper

2025-08-07 14:07:05 +03:00

README.md

How to test packages local

cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd