Niklas Ye
a0ea13955e
The actual fix for the human-onboarding gap niklas/terdut-server#23 found -- not a terdut-server change at all. A team-scoped credential is already owner-equivalent for POST/GET/DELETE /api/teams/{teamID}/invites (requireTeamOwner's synthetic-membership mechanism, ratified not accidental per that repo's SERVICE-ACCOUNTS.md), and invite redemption bypasses signup_mode entirely -- this TerdutTeam controller just never grew a feature to use either fact. New spec.invite{enabled, role (member|owner, default member), maxUses (1-100, default 1)} and status.inviteSecretRef. The Secret lives in the TerdutTeam's OWN namespace, not the operator's: unlike status.credentialsSecretRef (a durable, high-privilege credential, kept operator-side per DESIGN.md §6), an invite is bounded and limited-use, meant for this namespace's own human operators to read and hand out -- same precedent as TerdutAlertSource's status.webhookURLSecretRef, same- namespace and OwnerReference'd so deleting the TerdutTeam garbage-collects it automatically. internal/controller/terdutteam_invite.go: mints on first spec.invite.enabled, refreshes a day ahead of terdut-server's fixed 7-day TTL (reading the Secret's own stored expiresAt, no extra server round-trip per reconcile), revokes server-side and deletes the Secret when flipped back to false. A lost invite Secret is silently re-minted rather than treated as unrecoverable the way TerdutAlertSource's webhook key is -- nothing external holds a durable dependency on one specific invite link staying stable, it's read once by one human and handed out. New tdclient.Invite/CreateInvite/RevokeInvite. New envtest coverage: mint into the team's own namespace, refresh-before-expiry, revoke-on-disable (internal/controller/terdutteam_controller_test.go's new "spec.invite" Describe block), plus the fake server growing invite support (terdutserver_controller_test.go) -- its handleTeamSubPath dispatcher was split further (deadman switches into their own handleDeadmanSubPath, matching the existing handleIntegrationSubPath precedent) to stay under golangci-lint's gocyclo threshold with the new route added. examples/demo updated to prove this end to end: 02-team-platform.yaml turns on spec.invite; run-demo.sh's bootstrap_login/join_demo_teams (the psql signup_mode flip + a direct team_members INSERT) are replaced by redeem_platform_invite (reads status.inviteSecretRef, a real POST /api/signup with the invite token) and join_payments_team (POST /api/teams/{teamID}/members using Payments' own credential and alice's user id resolved via GET /api/users, deliberately not given its own spec.invite, so the demo shows both onboarding paths this feature unlocks) -- zero kubectl exec/psql calls remain anywhere in the script. README.md's "First login" section rewritten to match; it no longer documents the admin-token curl call that 403s against current terdut-server (niklas/terdut-server#23). Depends on niklas/terdut-server#24 (the callerMayManageServiceAccount fix for terdut-operator#3) being released before this is deployed for real -- not required to build or test this change itself, since the envtest fake never modeled that authorization gap to begin with.
24 lines
1.0 KiB
YAML
24 lines
1.0 KiB
YAML
# Two teams (this one and 03-team-payments.yaml) so the demo shows
|
|
# per-team isolation -- separate incident lists, separate escalation
|
|
# ladders, separate alert sources -- rather than one team standing in for
|
|
# everything.
|
|
apiVersion: terdut.ryuvia.com/v1alpha1
|
|
kind: TerdutTeam
|
|
metadata:
|
|
name: terdutteam-platform
|
|
spec:
|
|
# serverRef.namespace omitted: both this and terdut-operator-demo (01-server.yaml)
|
|
# live in whatever namespace you apply this directory into, which is the
|
|
# common case and needs no allowedTeams consent on the TerdutServer side
|
|
# (DESIGN.md §4.1, §4.6).
|
|
serverRef:
|
|
name: terdut-operator-demo
|
|
displayName: Platform
|
|
# No oidc block: this demo is password-login only (01-server.yaml).
|
|
# A real invite link, minted via this team's own credential, is how
|
|
# run-demo.sh's alice actually gets in -- no signup_mode flip, no admin
|
|
# token (see niklas/terdut-server#23's resolution). Role/maxUses left at
|
|
# their defaults (member, 1): one link for one person.
|
|
invite:
|
|
enabled: true
|