Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2026-10-09 14:56:22 +02:00
parent b0a431f2a4
commit e1103f2b7d
92 changed files with 2082 additions and 7561 deletions
@@ -25,12 +25,6 @@ resources:
 - terdutalertsource_admin_role.yaml
 - terdutalertsource_editor_role.yaml
 - terdutalertsource_viewer_role.yaml
- terdutdeadmanswitch_admin_role.yaml
- terdutdeadmanswitch_editor_role.yaml
- terdutdeadmanswitch_viewer_role.yaml
- terdutescalationrule_admin_role.yaml
- terdutescalationrule_editor_role.yaml
- terdutescalationrule_viewer_role.yaml
 - terdutteam_admin_role.yaml
 - terdutteam_editor_role.yaml
 - terdutteam_viewer_role.yaml
@@ -68,8 +68,6 @@ rules:
  - terdut.ryuvia.com
  resources:
  - terdutalertsources
-  - terdutdeadmanswitches
-  - terdutescalationrules
  - terdutservers
  - terdutteams
  verbs:
@@ -84,8 +82,6 @@ rules:
  - terdut.ryuvia.com
  resources:
  - terdutalertsources/finalizers
-  - terdutdeadmanswitches/finalizers
-  - terdutescalationrules/finalizers
  - terdutservers/finalizers
  - terdutteams/finalizers
  verbs:
@@ -94,8 +90,6 @@ rules:
  - terdut.ryuvia.com
  resources:
  - terdutalertsources/status
-  - terdutdeadmanswitches/status
-  - terdutescalationrules/status
  - terdutservers/status
  - terdutteams/status
  verbs:
@@ -1,27 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants full permissions ('*') over terdut.ryuvia.com.
-# This role is intended for users authorized to modify roles and bindings within the cluster,
-# enabling them to delegate specific permissions to other users or groups as needed.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutdeadmanswitch-admin-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches
-  verbs:
-  - '*'
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches/status
-  verbs:
-  - get
@@ -1,33 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants permissions to create, update, and delete resources within the terdut.ryuvia.com.
-# This role is intended for users who need to manage these resources
-# but should not control RBAC or manage permissions for others.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutdeadmanswitch-editor-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches/status
-  verbs:
-  - get
@@ -1,29 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants read-only access to terdut.ryuvia.com resources.
-# This role is intended for users who need visibility into these resources
-# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutdeadmanswitch-viewer-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutdeadmanswitches/status
-  verbs:
-  - get
@@ -1,27 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants full permissions ('*') over terdut.ryuvia.com.
-# This role is intended for users authorized to modify roles and bindings within the cluster,
-# enabling them to delegate specific permissions to other users or groups as needed.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutescalationrule-admin-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules
-  verbs:
-  - '*'
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules/status
-  verbs:
-  - get
@@ -1,33 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants permissions to create, update, and delete resources within the terdut.ryuvia.com.
-# This role is intended for users who need to manage these resources
-# but should not control RBAC or manage permissions for others.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutescalationrule-editor-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules
-  verbs:
-  - create
-  - delete
-  - get
-  - list
-  - patch
-  - update
-  - watch
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules/status
-  verbs:
-  - get
@@ -1,29 +0,0 @@
-# This rule is not used by the project terdut-operator itself.
-# It is provided to allow the cluster admin to help manage permissions for users.
-#
-# Grants read-only access to terdut.ryuvia.com resources.
-# This role is intended for users who need visibility into these resources
-# without permissions to modify them. It is ideal for monitoring purposes and limited-access viewing.
-
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/name: terdut-operator
-    app.kubernetes.io/managed-by: kustomize
-  name: terdutescalationrule-viewer-role
-rules:
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules
-  verbs:
-  - get
-  - list
-  - watch
- apiGroups:
-  - terdut.ryuvia.com
-  resources:
-  - terdutescalationrules/status
-  verbs:
-  - get