Aleksei Sviridkin 1af3fde88d feat(nats): publish ca.crt-only trust anchor to tenants ...

A tenant enabling TLS had no way to obtain the CA certificate without
also being granted a Secret that carries a private key, so the server
certificate could not actually be verified.

Render a TenantProjection sentinel naming the chart's CA Secret as the
source of a key-free CACert projection. The CA-extraction controller
publishes that projection as <release>.tenant-ca, and a label selector
on the application definition surfaces it to the tenant through
tenantsecrets. The key-bearing <release>-ca stays tenant-invisible.

The sentinel is gated on the chart's effective TLS state, the same
condition that governs the cert-manager objects, because the source
Secret exists only while TLS is on. It deliberately carries no
ownerReferences, namespace or chart-added labels: the controller derives
the published name from the helm.toolkit.fluxcd.io/name label Flux
stamps, and an ownerReference would short-circuit that lineage walk.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-08-12 18:42:13 +03:00

..

cozyrds

feat(nats): publish ca.crt-only trust anchor to tenants

2026-08-12 18:42:13 +03:00

templates

refactor: split cozystack-resource-definitions into separate packages

2025-12-30 14:00:31 +01:00

Chart.yaml

refactor: split cozystack-resource-definitions into separate packages

2025-12-30 14:00:31 +01:00

Makefile

refactor: move scripts to hack directory

2026-01-15 16:06:56 +01:00

values.yaml

refactor: split cozystack-resource-definitions into separate packages

2025-12-30 14:00:31 +01:00