openova/openova
1
0
Fork 0
Code Issues Pull Requests Actions 18 Packages Projects Releases Wiki Activity

chore(slot-13): pin bp-catalyst-platform to 1.4.147 (D21+D31 baked) (#1565)

Browse Source 
* feat(handover): auto-seed owner UserAccess CR on chroot (D21)

Closes the D21 gap on Sovereign DoD: /users page returned empty after
fresh handover because Keycloak `sovereign-admins` membership was
established but no UserAccess CR existed for the operator.

After `keycloak.EnsureUser` succeeds in `AuthHandover`, the helper
`EnsureOwnerUserAccess` upserts a cluster-scoped UserAccess CR shaped
like the canonical user_access.go `CreateUserAccess` write:

  apiVersion: access.openova.io/v1alpha1
  kind: UserAccess
  metadata:
    name: useraccess-owner-<sanitized-email>
    annotations:
      catalyst.openova.io/user-email: <email>   # rbac_matrix:309 hint
  spec:
    user:
      keycloakSubject: <email>
    sovereignRef: <fqdn-first-label>
    applications:
      - app: "*"
        role: admin                              # owner -> admin

The Composition (issue #322) reconciles the Claim into per-app
RoleBindings on the Sovereign so the operator surfaces in /users.

Best-effort + idempotent: AlreadyExists on the second handover is
folded to nil; any other error is logged at Warn and the handover
itself never fails. If the access.openova.io CRD has not rolled yet,
the next handover retries automatically.

Architect-first: mirrors `userAccessToUnstructured` shape and uses
existing `sovereignDynamicClient` + `rbacAssignSlug` seams. Tier
mapping follows the documented lossy `owner -> admin` rule in
`userAccessTierToRole` (CRD only accepts admin|editor|viewer).

Refs: docs/SOVEREIGN-MULTI-REGION-DOD.md D21

* chore(slot-13): pin bp-catalyst-platform to 1.4.147 (D21+D31 baked)

PR #1562 (D31 wordpress-tenant activeHotStandby) + PR #1564 (D21 owner
UserAccess auto-seed at handover, catalyst-api:8d2a947) both packaged
into chart 1.4.147. Pin slot so t133+ gets both gates on first prov.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
e3mrah 2026-05-16 23:58:46 +04:00 committed by GitHub
parent f8c8a87151
commit 3f8e2b925e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
clusters/_template/bootstrap-kit/13-bp-catalyst-platform.yaml
View File

@ -473,6 +473,11 @@ spec:
# from bitnamilegacy/kubectl:1.29.3 → alpine/k8s:1.31.4 in same
# commit (rule-17 MIRROR-EVERYTHING hygiene; bitnamilegacy is
# the Docker-Hub redirect for deprecated Bitnami 2025-08 cutover).
# 1.4.147 (D31 wordpress-tenant activeHotStandby + D21 owner auto-seed):
# - PR #1562 wires bp-cnpg-pair Primary+Replica pattern into
# wordpress-tenant chart via pg.activeHotStandby knob
# - PR #1564 baked into catalyst-api:8d2a947 — handover now
# auto-seeds the operator's UserAccess CR (D21 zero-touch)
# 1.4.146 (D29 billing internal JWT bypass for public routes):
# - PR #1561 mirrors PR #1559's gateway public routes in the billing
# service's own JWT middleware. Without this, the gateway passed
@ -488,7 +493,7 @@ spec:
# 2026-05-16 with admin:b0ed216 stuck in ImagePullBackOff)
# - PR #1556 adds the billing→notification wire so the voucher
# issuance flow emails the recipient (D28 zero-touch contract)
version: 1.4.146
version: 1.4.147
sourceRef:
kind: HelmRepository
name: bp-catalyst-platform