feat: namespace-scoped application family - #77

Open

drey wants to merge 145 commits into

mainfrom

feat/ns-scoped-applications

Commits on Sep 10, 2026

refactor(api): extract the shared chart catalog naming scheme
drey
committed
fee4e24
feat(api): add the HelmApplicationRepository custom resource
drey
committed
941c23e
feat(api): add the HelmClusterApplicationRepository custom resource
drey
committed
f64f5bf
feat(api): add the HelmApplicationChart custom resource
drey
committed
bdf0800
feat(api): add the HelmClusterApplicationChart custom resource
drey
committed
7cffbcd
feat(api): add the HelmApplication custom resource
drey
committed
5e3d6bd
feat(api): bound the HelmApplication name and add status repository helpers
drey
committed
09542a2
internal: drop the permissions claim from the HelmApplication description
drey
committed
b1d1072
refactor(api): share one spec and status across the repository kinds
drey
committed
c66105b
refactor(api): share one status across the chart catalog kinds
drey
committed
4064271
feat(controller): derive internal names for namespaced sources
drey
committed
26f60e1
feat(controller): add the repository source contract and its adapters
drey
committed
403e83d
feat(controller): mirror repository catalogs through a kind-agnostic catalog
drey
committed
0acc321
refactor(controller): reconcile repository secrets and sources through the contract
drey
committed
47c1bb3
refactor(controller): synchronize catalogs through the contract
drey
committed
3eee116
refactor(controller): reconcile every repository kind with one reconciler
drey
committed
dc92728
feat(controller): map internal resources back to a namespaced source
drey
committed
570acf5
feat(controller): reconcile HelmApplicationRepository and HelmClusterApplicationRepository
drey
committed
ee8a327
fix(controller): address the whole-branch review of the repository generalization
drey
committed
2fc82f1
feat(controller): add the release source contract
drey
committed
92501eb
feat(controller): adapt HelmClusterAddon to the release contract
drey
committed
9ba96cf
refactor(controller): drive the chart, release and maintenance services through the release contract
drey
committed
53b7b2c
refactor(controller): reach a repository's consumers through a release lister
drey
committed
36c538e
refactor(controller): claim charts and ensure namespaces through the release contract
drey
committed
249c258
refactor(controller): reconcile every release kind with one reconciler
drey
committed
b3bdf41
feat(controller): adapt HelmApplication to the release contract
drey
committed
83369b5
feat(controller): provide the identity an application release is applied with
drey
committed
7761ce1
feat(controller): map repositories and catalogs to the applications using them
drey
committed
06f24bc
feat(controller): reconcile HelmApplication
drey
committed
b2adb96
docs(api): state what creating a HelmApplication grants
drey
committed
655511f
fix(controller): address the whole-branch review of the release generalization
drey
committed
cff7751

Commits on Sep 11, 2026

refactor(chart-values): key auxiliary resources by the repository namespace too
drey
committed
e26ec01
feat(chart-values): describe a repository kind by its family
drey
committed
ca6016b
feat(chart-values): resolve charts of the application repositories
drey
committed
a2e2e27
feat(chart-values): authorize a request by the resource its answer feeds
drey
committed
0e3b044
fix(chart-values): let a namespace reach a cluster-scoped repository request
drey
committed
5340d21
fix(chart-values): restore the released response contract
drey
committed
3b5f257
chore(chart-values): fix stale comments and a deprecated test helper
drey
committed
14f94fd
test(chart-values): make two frozen assertions actually bite
drey
committed
50ece84
feat(chart-values): grant read access to the application repositories
drey
committed
a1a58a6
test(e2e): add helpers for the application family
drey
committed
5890851
test(e2e): pin the derived service-account name against the operator
drey
committed
59ab93f
test(e2e): cover the namespaced repository lifecycle
drey
committed
b21de1e
test(e2e): cover the application lifecycle, identity and isolation
drey
committed
a3c9812
test(e2e): make the application spec discriminate
drey
committed
8ea9cb4
test(e2e): make the repository isolation spec discriminate
drey
committed
ba5ec4f
chore(controller): clear the lint findings this branch introduced
drey
committed
998821e
fix(rbac): narrow the controller's rights over the seeded role
drey
committed
61bab9c
fix(controller): name a cluster-scoped object without a leading slash
drey
committed
5f41da4
docs: document the namespace-scoped application family
drey
committed
49c9db7
fix(rbac): grant bind on the role, not on the role binding
drey
committed
a4aa50a
chore: align the Go version of api with its consumers
drey
committed
2f46ce0
chore: add a unit-test task to every module
drey
committed
389f01a
ci: run the unit tests on every pull request
drey
committed
98b9d0a
ci: verify the generated files are committed
drey
committed
c6f07f5
chore: name the per-module test task after what it runs
drey
committed
ffe72c0
fix(naming): drop a dot the truncation leaves behind
drey
committed
e376870
fix(naming): make the application catalog name injective
drey
committed
dc84304
fix(chart-values): reject a namespace no cluster could have
drey
committed
aac1c8e
test(controller): pin that a cut release name stays distinct
drey
committed
85020f1
feat(rbac): grant user-facing RBAC on the helm.deckhouse.io resources
drey
committed
730062f
fix(controller): don't delete or clobber a role binding we may not own
drey
committed
1b336c3
fix(controller): stop caching service accounts and role bindings
drey
committed
a61e821
fix(controller): stop namespace_service doc overclaiming its scope
drey
committed
46b40ad
test(webhook): cover ValidateCreate/ValidateUpdate for system namespaces
drey
committed
39c4d64
fix(naming): make the addon chart catalog name injective too
drey
committed
fbd0ead
feat(controller): migrate addon chart catalog objects to their new name
drey
committed
9173ff6
fix(naming): hash the pair, not the ambiguous join
drey
committed
de8aa3d
chore: install golangci-lint with the toolchain we already have
drey
committed
87772f9
docs(taskfile): say which image directories are not ours
drey
committed
de96ff9
fix(controller): migrate every catalog object, not only the published ones
drey
committed
cc9c85b
fix(rbac): grant the manage roles a rule on their own ModuleConfig
drey
committed
b88baf2
fix(naming): trim a trailing dash or dot on an untruncated repository name
drey
committed
f62feb6
docs(controller): explain why the service account delete needs no ownership check
drey
committed
ebc24bf
chore: apply the formatting the current linter expects
drey
committed
a9f0121
fix: clear the static analysis findings the linter reports
drey
committed
db5ab50
test(controller): keep the fixture parameters the linter would drop
drey
committed
6921cce
chore: keep prettier away from the chart-values werf template
drey
committed
fabf6f2
fix(controller): rename the catalog objects without waiting on the remote
drey
committed
c5b5ede
chore: keep the linter binary out of the chart
drey
committed
215de04
fix(controller): report a failed rename instead of going silent
drey
committed
1a86de8
docs(controller): give Sync back its own doc comment
drey
committed
36c6945
ci: run the linters again
drey
committed
54656c2
chore: align the Go version of the hooks module too
drey
committed
ee2f838
fix(controller): report a failed rename on a pass that syncs nothing
drey
committed
5ff439a

Commits on Sep 13, 2026

Commits on Sep 15, 2026

fix(controller): stop treating default as a system namespace
drey
committed
78f08be
feat(api): report how many charts a repository offers
drey
committed
a682fae

Commits on Sep 16, 2026

feat(rbac): reach the module through Editor and Admin only
drey
committed
cc134b5
feat(rbac): move the application level to PrivilegedUser
drey
committed
c611836
feat(rbac): give ClusterAdmin the cluster-scoped kinds
drey
committed
ea803d0
feat(rbac): fold the application rights into Admin
drey
committed
dcf2eac
feat(rbac): let Admin read the cluster-wide chart catalog
drey
committed
a1ab74d
feat(rbac): let every reader watch what it can list
drey
committed
1c42753

Commits on Sep 18, 2026

feat: migrate to upstream flux controllers (#78)
drey
authored
57d414d

Commits on Sep 19, 2026

Commits on Sep 21, 2026

Commits on Sep 23, 2026