Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2.3 KiB
terdut-operator
Kubebuilder/controller-runtime operator for terdut-server. See DESIGN.md for the
design (start with its revision section: credentials and the CRD catalog) and
ROADMAP.md for status and deferred work. README.md stays the
short pitch.
Checks
make fmt lint test helm-lint is the CI gate (.gitea/workflows/ci.yaml's test,
security and chart jobs call these targets rather than restating them, same
convention as terdut-server). test chains through the Kubebuilder-scaffolded
manifests/generate (controller-gen) and setup-envtest targets automatically —
everything needed lands in bin/ (gitignored) on first run, no separate tool install
required beyond Go itself and network access to proxy.golang.org/storage.googleapis.com.
security runs make security-go/security-secrets (govulncheck/gitleaks), same as
terdut-server's own security job.
There is no CI end-to-end job: the golden-path kind pass is manual, via
examples/demo/run-demo.sh (see ROADMAP.md).
Release
Wired: .release.conf, make release-vars/helm-lint/
push/helm-package/helm-push/release, and .gitea/workflows/release.yaml
(test → image/chart → scan-image) all follow terdut-server's established shape —
see that repo's Makefile/.release.conf for the shared reasoning, not restated here.
The chart is charts/terdut-operator (via kubebuilder's own helm/v2-alpha plugin,
regenerate with kubebuilder edit --plugins helm.kubebuilder.io/v2-alpha --output-dir charts --force after config/ changes, then re-review — --force does not touch
Chart.yaml but does touch values.yaml, which carries hand-written additions, most
importantly the optional terdutServer block, DESIGN.md §10). It installs the operator +
CRDs + RBAC, and optionally one TerdutServer CR (terdutServer.enabled, off by default).
That one-time manual step — hand-creating the initial terdut-operator/ wrapper entry
under Ryuvia/charts, since chart-bump only ever bumps an existing one — is done. It
happened during this repo's actual first release (v0.1.1, 2026-10-01; v0.1.0 published but
never deployed anywhere, after its own scan-image found a CVE in the grpc version it had
just bumped to). Every release since bumps that wrapper entry like any other onboarded
repo's.