From 5f93a530fac63aa9095a4f41850d4e76e7f9f9dd Mon Sep 17 00:00:00 2001 From: Niklas Ye Date: Wed, 30 Sep 2026 22:21:28 +0200 Subject: [PATCH] =?UTF-8?q?DESIGN.md=20=C2=A74.1/=C2=A76:=20drop=20namespa?= =?UTF-8?q?ce=20from=20credentialsSecretRef,=20add=20key?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It's always the operator's own namespace by construction now (§6), never anything else, so there was nothing for the field to vary -- key varies instead (fixed 'token' when self-generated, whatever a human chose when adopted from spec.credentialsSecretRef). --- DESIGN.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index 16634b0..f723a02 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -192,7 +192,7 @@ status: conditions: [...] # Ready, DatabaseReady, Bootstrapped observedGeneration: 3 serviceName: terdut - credentialsSecretRef: {name: terdut.platform-oncall-instance-credentials, namespace: terdut-operator-system} # see §6; lives in the OPERATOR's namespace, not this TerdutServer's + credentialsSecretRef: {name: terdut.platform-oncall-instance-credentials, key: token} # see §6; lives in the OPERATOR's namespace (always, implicitly -- not stored here), not this TerdutServer's. No `namespace` field: unlike an earlier draft, it's never anything other than the operator's own, so there's nothing to record. `key` replaces it, since that *does* vary -- fixed ("token") when the controller generated this Secret itself, whatever the human chose when it was adopted from spec.credentialsSecretRef instead. ``` Field-for-field this is the chart's `values.yaml` reshaped as a spec — the @@ -493,11 +493,11 @@ when nothing ever crosses into a tenant namespace in the first place. 2. On the self-registration path only (point 1's bring-your-own path generates nothing — it adopts the human-provided Secret directly): the resulting instance-scoped key is written to a generated Secret in the - **operator's own namespace** (e.g. `.-instance-credentials`), - referenced back from `TerdutServer.status.credentialsSecretRef: {name, - namespace}` (§4.1) — `namespace` is part of the reference now, since it's - no longer the same namespace as the `TerdutServer` itself. No - `OwnerReference` (those can't cross namespaces); the `TerdutServer`'s + **operator's own namespace** (e.g. `.-instance-credentials`, + under a fixed data key, `token`), referenced back from + `TerdutServer.status.credentialsSecretRef: {name, key}` (§4.1). No + `OwnerReference` (those can't cross namespaces, and this Secret doesn't + share a namespace with the `TerdutServer` that caused it); the `TerdutServer`'s finalizer deletes this Secret directly as part of its own teardown, the same way it already has to clean up the server-side resources it created (§5's general finalizer rule extends naturally to this Secret).