Niklas Ye
e1103f2b7d
Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
47 lines
2.2 KiB
YAML
47 lines
2.2 KiB
YAML
# The one TerdutServer this whole demo runs against. Everything else in
|
|
# this directory (teams with their escalation and dead man's switches,
|
|
# alert sources) references it by name.
|
|
#
|
|
# The operator never creates any ingress/HTTPRoute for this TerdutServer --
|
|
# that's a permanent non-goal (DESIGN.md §1, NetworkingSpec's own doc
|
|
# comment), not a missing feature. This demo reaches it only by
|
|
# port-forwarding its Service, same name as this object (see README.md);
|
|
# see ../networking for worked examples of exposing it yourself instead.
|
|
apiVersion: terdut.ryuvia.com/v1alpha1
|
|
kind: TerdutServer
|
|
metadata:
|
|
name: terdut-operator-demo
|
|
spec:
|
|
image:
|
|
repository: git.ryuvia.com/niklas/terdut-server
|
|
# v0.36.0 is the floor now that replicas below is 2 (this demo pins
|
|
# the current release, v0.43.0, so it shows the current web UI too): that
|
|
# release put the sweeper, the notifier and the migration runner each
|
|
# behind a Postgres advisory lock, and gave incident creation its own
|
|
# conflict resolution, which is what makes a second replica safe
|
|
# instead of racing the first. (Still carries v0.34.0's fix too --
|
|
# callerMayManageServiceAccount, so an instance-scoped service account
|
|
# can adopt/rotate a key on a team-scoped account it didn't just create
|
|
# in the same call -- without which terdutteam-* can wedge permanently
|
|
# on the crash-window race this demo hit live, niklas/terdut-operator#3.)
|
|
tag: v0.43.0
|
|
# Matches this CRD's own spec.replicas default (v0.4.0) -- stated
|
|
# explicitly, like every other field in this file, rather than left to
|
|
# the default. RollingUpdate follows automatically; this operator does
|
|
# not expose Strategy as a spec field.
|
|
replicas: 2
|
|
networking:
|
|
hostname: terdut-operator-demo.example
|
|
servicePort: 8080
|
|
database:
|
|
dsn: "postgres://terdut@terdut-operator-demo-postgres:5432/terdut?sslmode=disable"
|
|
passwordSecretRef:
|
|
name: terdut-operator-demo-postgres
|
|
key: password
|
|
sweeper:
|
|
staleAfter: 6h
|
|
archiveAfter: 168h
|
|
# No oidc block: password login only, so there's nothing external to
|
|
# register a redirect URI with before this demo can sign in.
|
|
passwordLogin: true
|