mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
f0b77de1e2
Two claims of mine were wrong about mechanism. The empty-selector warning said such a selector would project every Secret in the namespace. The lineage webhook computes those labels only for objects whose ownership resolves to the application, so the reach is the instance's own Secrets. Still the thing to prevent — that set contains -ca-tls and -tls — but the stated reason should match the code, since it is what a reader checks the guard against. The teardown step told the user to delete both Secrets with no ordering. The server keypair stays mounted in the running pods until the operator reissues from its own CA and rolls the StatefulSet, so following that literally leaves the next pod unable to start. Wait for the rollout first. Signed-off-by: Aleksei Sviridkin <f@lex.la>
How to test packages local
cd packages/core/installer
make image-cozystack REGISTRY=YOUR_CUSTOM_REGISTRY
make apply
kubectl delete po -l app=source-controller -n cozy-fluxcd