Aleksei Sviridkin 8a6f4884cb fix(mariadb): publish the tenant CA anchor through a projection, not by name ...

The dashboard Role and the ApplicationDefinition granted the operator's
key-free mariadb-<name>-ca-bundle Secret directly by name. Every other
converged engine (mongodb, postgres, nats, qdrant) instead renders a
TenantProjection that lifts ca.crt into the canonical <release>.tenant-ca
object, reached through core.cozystack.io/tenantsecrets rather than a
per-Secret grant.

Add templates/tenant-projection.yaml sourcing from the operator's
ca-bundle, drop the name grant from the dashboard Role and from the
ApplicationDefinition's secrets.include (the existing tenant-ca
matchLabels selector now has something to match), and remove the
ApplicationDefinition's caCert field, which named a field the
ApplicationDefinition CRD does not define and would have rejected the
whole object under server-side apply.

Update the README and the pinned RBAC tests to the new tenant-ca name.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-09-03 01:38:53 +03:00

..

application-definition-crd

feat(api)!: require the application release prefix to be dot-free

2026-07-22 00:07:55 +03:00

backup-controller

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

backupstrategy-controller

fix(backupstrategy-controller): gate the default MongoDB strategy on bootstrap

2026-08-14 14:53:13 +05:00

bootbox

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

bootbox-rd

[docs] Updated app go types

2026-03-25 15:57:25 +05:00

bucket

fix(backupstrategy-controller): repair the bucket credentials Secret from the gate, not a chart fail

2026-08-07 11:10:41 +02:00

bucket-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

capi-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

capi-providers-bootstrap

fix(kubernetes): address review findings on Talos worker bootstrap

2026-06-23 14:45:53 +05:00

capi-providers-core

fix(capi): add startupProbe to capi-controller-manager to survive cert provisioning delay (#2946)

2026-06-18 10:40:05 +05:00

capi-providers-cpprovider

fix(ci): emit a single tag for capi-providers under OCI export (#3257)

2026-07-29 17:47:26 +05:00

capi-providers-infraprovider

fix(cluster-api): fix kamaji OOM and set limits on unset providers

2026-05-21 12:57:02 +05:00

cert-manager

fix(cert-manager): move the webhook off the kubelet's port

2026-07-20 00:20:06 +03:00

cert-manager-crds

test(cert-manager-crds): pin the keep annotation on the CRDs

2026-08-07 14:36:06 +03:00

cert-manager-issuers

feat(platform): add deletion-protection guardrail via ValidatingAdmissionPolicy

2026-05-26 14:18:22 +05:00

cilium

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

cilium-networkpolicy

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

clickhouse-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

clickhouse-rd

feat(clickhouse): add configurable version parameter

2026-08-24 23:41:27 +03:00

cluster-autoscaler

feat(cluster-autoscaler): enable enforce-node-group-min-size by default

2026-02-14 11:42:52 +01:00

clustersecret-operator

Add clustersecret-operator system package

2026-02-10 22:47:20 +05:00

computeplane-rd

docs(computeplane): nodeGroups allowlist drops unlisted fields, not pass-through

2026-08-25 16:39:19 +03:00

coredns

chore(packages/system/coredns): refresh coredns chart to 1.46.0

2026-06-22 21:46:49 +03:00

cozy-proxy

feat(cozy-proxy): bump to v0.3.0

2026-04-28 11:14:27 +02:00

cozystack-api

test(seaweedfs,api): bound both Roles against a respelled rule

2026-08-08 03:09:47 +03:00

cozystack-basics

feat(valkey): register Valkey application in the platform

2026-09-01 11:43:10 +04:00

cozystack-controller

docs(postgres): name the trust anchor as the tenant actually sees it

2026-08-17 03:10:24 +03:00

cozystack-scheduler

[cozystack-scheduler] Publish SchedulingClass demo (#2252)

2026-07-30 14:20:18 +05:00

dashboard

fix(console): address the review findings on the Admin portal rework

2026-08-24 10:45:20 +02:00

etcd-operator

test(etcd-operator): pin deployment unittest to v0.5.4

2026-08-04 13:09:25 +04:00

etcd-operator-crds

test(tests): pin the keep annotation on cert-manager and etcd-operator CRDs (#3590)

2026-08-07 17:47:24 +03:00

etcd-rd

docs(etcd): note that affinity is not applied to existing members

2026-09-01 12:47:46 +03:00

external-dns

[external-dns] Set resources requests/limits on external-dns container

2026-07-03 19:14:15 +03:00

external-dns-rd

ci(external-dns): regenerate cozyrds schema for gatewayAPI description

2026-05-25 19:11:52 +03:00

external-secrets-operator

fix(external-secrets): move the webhook off the kubelet's port

2026-07-20 04:49:57 +03:00

flux-plunger

chore(deps): update container image & action digests

2026-07-10 05:29:23 +00:00

flux-shard-operator

fix(flux-shard-operator): repair sharded helm-controller crashloop behind an HTTP proxy (#3546)

2026-08-14 13:28:51 +03:00

foundationdb-operator

chore(packages/system/foundationdb-operator): bump fdb-operator to v2.30.0

2026-06-23 03:47:31 +03:00

foundationdb-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

gateway-api-crds

fix(gateway-api-crds): keep the CRDs when the release is uninstalled

2026-08-07 14:37:46 +03:00

goldpinger

[goldpinger] Set resources requests/limits on goldpinger DaemonSet

2026-07-03 19:14:27 +03:00

gpu-operator

feat(gpu-operator): add container variant for preinstalled host driver

2026-06-08 16:58:51 +03:00

grafana-operator

build(grafana-operator): mirror Grafana catalog plugins into the dashboards image

2026-07-24 16:08:51 +02:00

hami

chore(packages/system/hami): bump HAMi to 2.9.0

2026-06-22 19:09:10 +03:00

harbor

test(harbor): assert the operator-group label and pinned engine

2026-08-19 10:15:58 +02:00

harbor-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

hetzner-robotlb

chore(hetzner-robotlb): update robotlb chart to appVersion 0.0.6

2026-04-23 16:57:23 +05:00

http-cache-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

info-rd

refactor(labels): remove cozystack.io/ui label

2026-01-19 13:59:29 +01:00

ingress-nginx

fix(ingress-nginx): re-pin to the segfault-free v1.11.5 rebuild

2026-09-01 18:28:04 +05:00

ingress-rd

feat(ingress): add proxyProtocol knob to ingress-nginx

2026-06-09 12:50:35 +03:00

kafka-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

kafka-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

kamaji

feat(kubernetes)!: remove the FluxCD tenant addon

2026-08-20 13:34:32 +03:00

keycloak

chore(keycloak): bump KMS proxy to 0.2.2

2026-08-28 17:11:41 +05:00

keycloak-configure

fix(keycloak-configure): patch HelmRelease in release namespace on teardown

2026-07-28 00:11:16 +03:00

keycloak-operator

fix(keycloak): keep KeycloakRealmUser roles when spec.roles is unset

2026-08-12 18:42:14 +03:00

kilo

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

kubeovn

feat(kubeovn): build the chart and image in-tree

2026-07-28 18:07:33 +02:00

kubeovn-plunger

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

kubeovn-webhook

fix(kubeovn-webhook): address review on the webhook network policy

2026-08-26 19:01:24 +02:00

kubernetes-nodes-rd

Merge branch 'main' into feat/kubernetes-nodes-phase2b

2026-08-19 13:14:11 +03:00

kubernetes-rd

Merge branch 'main' into feat/kubernetes-nodes-phase2b

2026-08-20 14:04:32 +03:00

kuberture

test(kuberture): pin shim contract with helm-unittest

2026-05-14 16:49:00 +03:00

kubevirt

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

kubevirt-cdi

feat(kubevirt-cdi): make cloneStrategyOverride configurable

2026-07-03 19:14:33 +03:00

kubevirt-cdi-operator

fix(kubevirt-cdi-operator): add startupProbe to survive slow leader election

2026-05-25 11:54:45 +05:00

kubevirt-csi-node

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

kubevirt-instancetypes

fix(kubevirt-instancetypes): restore persistent EFI/TPM state

2026-07-06 09:49:50 +05:00

kubevirt-operator

chore(kubevirt-operator): update to v1.8.4

2026-06-24 15:50:36 +03:00

lineage-controller-webhook

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

linstor

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

linstor-gui

fix(linstor-gui): stop requesting offline_access so logout can revoke sessions

2026-07-24 14:19:24 +03:00

linstor-scheduler

fix(linstor-scheduler): re-vendor to upstream 0.3.1 with native admission webhook

2026-07-16 16:57:41 +03:00

local-ccm

Update local-ccm v0.3.0

2026-02-10 20:19:03 +01:00

mariadb-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

mariadb-rd

fix(mariadb): publish the tenant CA anchor through a projection, not by name

2026-09-03 01:38:53 +03:00

metallb

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

metrics-server

fix(metrics-server): move the listener off the kubelet's port

2026-07-20 05:24:04 +03:00

mongodb-operator

chore(packages/system/mongodb-operator): bump psmdb-operator to 1.22.0

2026-06-22 18:55:38 +03:00

mongodb-rd

fix(mongodb): declare the trust anchor with a TenantProjection

2026-09-01 11:20:32 +03:00

monitoring

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

monitoring-agents

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

monitoring-rd

fix(monitoring): promote oidc.users[].role to required + regenerate schema

2026-07-15 15:31:45 +03:00

multus

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

nats

chore(packages/system/nats): bump nats to 1.3.16

2026-06-22 20:05:54 +03:00

nats-rd

feat(nats): publish ca.crt-only trust anchor to tenants

2026-08-12 18:42:13 +03:00

nfs-driver

chore(packages/system/nfs-driver): bump csi-driver-nfs to 4.13.3

2026-06-22 18:51:06 +03:00

objectstorage-controller

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

openbao

chore(packages/system/openbao): bump openbao chart to 0.25.7

2026-06-23 03:25:16 +03:00

openbao-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

opencost

chore(packages/system/opencost): bump opencost chart to 2.5.23

2026-06-23 14:39:14 +03:00

opensearch-operator

fix(opensearch-operator): use RollingUpdate maxSurge=0 instead of Recreate

2026-07-20 11:33:35 +05:00

opensearch-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

ouroboros

test(system): anchor index-addressed negative asserts to what they name

2026-08-12 15:28:37 +03:00

piraeus-operator

[piraeus-operator] Split LINSTOR controller availability and metrics alerts

2026-03-25 16:11:14 +03:00

piraeus-operator-crds

Move CRDs installation logic to piraeus-operator-crds chart

2026-02-11 22:54:56 +01:00

postgres-operator

docs(postgres-operator): distinguish chart version from appVersion in comment

2026-08-25 18:52:30 +03:00

postgres-rd

fix(postgres): let in-place restore re-bootstrap instead of wedging

2026-08-25 17:31:53 +04:00

prometheus-operator-crds

fix(prometheus-operator-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

qdrant

[qdrant] Add Qdrant vector database application

2026-02-06 13:30:58 +03:00

qdrant-rd

feat(qdrant): publish ca.crt-only trust anchor to tenants

2026-08-09 21:06:46 +03:00

rabbitmq-operator

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

rabbitmq-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

redis-operator

fix(redis-operator): use REDISCLI_AUTH for valkey-cli auth in generated scripts

2026-09-01 14:41:32 +04:00

redis-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

reloader

fix(reloader): add startupProbe to survive slow first start under load

2026-07-28 12:16:57 +03:00

seaweedfs

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

seaweedfs-db

test: cover flux v2.8 chart fixes and wire missing test targets

2026-05-31 15:02:33 +05:00

seaweedfs-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

securitygroup-controller

Prepare release v1.6.0 (promoted from v1.6.0-rc.4)

2026-07-22 13:00:10 +00:00

snapshot-controller

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tcp-balancer-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

telepresence

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

tenant-rd

fix(computeplane): address review round three

2026-07-28 18:08:03 +02:00

valkey-rd

feat(valkey): register Valkey application in the platform

2026-09-01 11:43:10 +04:00

velero

fix(platform): give node DaemonSets memory requests and limits

2026-08-13 16:47:52 +05:00

vertical-pod-autoscaler

fix(http-cache,vpa): fix haproxy 3.3 backend name conflict and vpa-for-vpa OOM (#2654)

2026-07-22 20:57:45 +03:00

vertical-pod-autoscaler-crds

fix(vertical-pod-autoscaler-crds): keep the CRDs on uninstall

2026-08-07 14:37:46 +03:00

victoria-metrics-operator

feat(monitoring): upgrade victoria-metrics-operator to v0.68.4

2026-04-20 15:48:53 +03:00

virtualprivatecloud-rd

[docs] Update cozyvalues-gen

2026-03-25 15:59:22 +05:00

vm-default-images

fix(vm-default-images): refresh stale Alpine and openSUSE 16.0 image URLs

2026-06-25 12:56:49 +05:00

vm-disk-rd

fix(vm-disk): fail on storageClass/source edit of existing disk

2026-08-28 18:26:36 +03:00

vm-instance-rd

chore(apps): regenerate schemas and ApplicationDefinitions with x-cozystack-options

2026-06-02 16:42:58 +03:00

vpn-rd

feat(apps): instance-type resourcesPreset across apps and extras

2026-05-11 21:08:41 +03:00

vsnap-crd

fix(vsnap-crd): keep the CRDs when the release is uninstalled

2026-08-07 14:37:46 +03:00

.gitattributes

chore(codeowners): don't gate per-app generated files on architect review

2026-08-03 14:08:36 +03:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00