IvanHunters ff4ef2c189 fix(monitoring): force allow_sign_up=false and gate isolation dict on users-map ...

Address PR#3176 review round-2 gap-1: the docs promise "users not in
spec.oidc.users get nothing", but Grafana's default allow_sign_up=true
combined with the chart-forced skip_org_role_sync=true was minting a
Viewer account for every cozy-realm identity that completed the OAuth
flow, then reaping it on the next helm-upgrade prune pass.

The chart-forced isolation dict (now three keys: skip_org_role_sync,
oauth_allow_insecure_email_lookup, allow_sign_up=false) is applied only
when spec.oidc.users is non-empty. A BYO-IdP operator who does not use
the users-map gets none of the three forced on top of their inline
config, matching the review's minor: forcing insecure_email_lookup
against an issuer that may not verify emails is a needless account-
linking surface, and allow_sign_up=false with no pre-provisioned
accounts would lock everyone out.

Tests split the two branches: users-active asserts all three keys are
present and the operator cannot override them via CustomConfig-inline;
users-empty asserts the auth.generic_oauth block is emitted without
any of the isolation keys.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>

2026-07-15 15:31:45 +03:00

..

apps

fix(kubernetes): re-pin deleted centos:stream9 digest for kubevirt-csi-driver

2026-07-15 12:54:24 +03:00

core

chore(monitoring): sync PackageSource comment with removed Keycloak groups

2026-07-15 15:31:45 +03:00

extra

fix(monitoring): promote oidc.users[].role to required + regenerate schema

2026-07-15 15:31:45 +03:00

library

fix(cozy-lib,harbor,mariadb): digest-pin cleanup-hook kubectl image and route it through cozy-lib.images-registry

2026-07-02 17:44:59 +03:00

system

fix(monitoring): force allow_sign_up=false and gate isolation dict on users-map

2026-07-15 15:31:45 +03:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00