Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
42 lines
2.3 KiB
Markdown
42 lines
2.3 KiB
Markdown
# terdut-operator
|
|
|
|
Kubebuilder/controller-runtime operator for terdut-server. See `DESIGN.md` for the
|
|
design (start with its revision section: credentials and the CRD catalog) and
|
|
`ROADMAP.md` for status and deferred work. `README.md` stays the
|
|
short pitch.
|
|
|
|
## Checks
|
|
|
|
`make fmt lint test helm-lint` is the CI gate (`.gitea/workflows/ci.yaml`'s `test`,
|
|
`security` and `chart` jobs call these targets rather than restating them, same
|
|
convention as terdut-server). `test` chains through the Kubebuilder-scaffolded
|
|
`manifests`/`generate` (`controller-gen`) and `setup-envtest` targets automatically —
|
|
everything needed lands in `bin/` (gitignored) on first run, no separate tool install
|
|
required beyond Go itself and network access to `proxy.golang.org`/`storage.googleapis.com`.
|
|
`security` runs `make security-go`/`security-secrets` (govulncheck/gitleaks), same as
|
|
terdut-server's own `security` job.
|
|
|
|
There is no CI end-to-end job: the golden-path `kind` pass is manual, via
|
|
`examples/demo/run-demo.sh` (see ROADMAP.md).
|
|
|
|
## Release
|
|
|
|
Wired: `.release.conf`, `make release-vars`/`helm-lint`/
|
|
`push`/`helm-package`/`helm-push`/`release`, and `.gitea/workflows/release.yaml`
|
|
(`test` → `image`/`chart` → `scan-image`) all follow terdut-server's established shape —
|
|
see that repo's Makefile/`.release.conf` for the shared reasoning, not restated here.
|
|
|
|
The chart is `charts/terdut-operator` (via kubebuilder's own `helm/v2-alpha` plugin,
|
|
regenerate with `kubebuilder edit --plugins helm.kubebuilder.io/v2-alpha --output-dir
|
|
charts --force` after `config/` changes, then re-review — `--force` does not touch
|
|
`Chart.yaml` but does touch `values.yaml`, which carries hand-written additions, most
|
|
importantly the optional `terdutServer` block, DESIGN.md §10). It installs the operator +
|
|
CRDs + RBAC, and optionally one `TerdutServer` CR (`terdutServer.enabled`, off by default).
|
|
|
|
That one-time manual step — hand-creating the initial `terdut-operator/` wrapper entry
|
|
under `Ryuvia/charts`, since `chart-bump` only ever bumps an existing one — is done. It
|
|
happened during this repo's actual first release (v0.1.1, 2026-10-01; v0.1.0 published but
|
|
never deployed anywhere, after its own `scan-image` found a CVE in the grpc version it had
|
|
just bumped to). Every release since bumps that wrapper entry like any other onboarded
|
|
repo's.
|