cmd: add zero-managed mode to all-in-one command

[kenjenkins]

Summary

Add a new flag --pomerium-zero-token to the all-in-one command. When this flag is provided, ingress-controller will launch Core in the Zero-managed mode using the given token.

In this mode, we can't directly configure a health check listener in Core, so run a separate no-op /readyz check handler in addition to the main Zero-managed mode entry point.

Also, in this mode the bootstrap secrets are not required, so change the Secrets field of the Pomerium CRD from required to optional. This does come at a cost for the regular (non-Zero) mode: if you try to save the CRD without the bootstrap secrets, before you would get a validation error from the kube-apiserver and now you would get a runtime error from ingress-controller.

Related issues

https://linear.app/pomerium/issue/ENG-4170/ingress-controller-as-the-default-install-path-for-zerokubernetes-post

Checklist

• reference any related issues
• updated docs
• updated unit tests
• updated UPGRADING.md
• add appropriate tag (improvement / bug / etc)
• ready for review

[greptile-apps]

Greptile Summary

The PR adds a Zero-managed execution mode to the all-in-one command, including a standalone readiness listener and Kubernetes leader election for Sync API reconciliation.

• Adds the --pomerium-zero-token flag and branches startup into Zero-managed and bootstrap-managed flows.
• Registers the Kubernetes Zero bootstrap writer and updates indirect dependencies.
• Moves leader-election options into shared ingress-controller flags.
• Makes Pomerium.spec.secrets optional, but the settings fetch path still rejects an omitted value.

Confidence Score: 4/5

The omitted-secret reconciliation failure needs to be fixed before merging because the CRD now accepts a configuration that the controller cannot process.

The updated API permits spec.secrets to be omitted, but the fetcher treats the resulting empty string as a secret name and returns a parsing error on every reconciliation.

Files Needing Attention: controllers/settings/fetch.go, apis/ingress/v1/pomerium_types.go

Important Files Changed

Filename	Overview
cmd/all_in_one.go	Adds the Zero-managed startup branch, standalone health handler, and conditional Kubernetes leader election; no independently established defect remained after context review.
controllers/settings/fetch.go	Attempts to make bootstrap secrets optional but passes a pointer to an empty string into the lookup, causing omitted values to fail parsing.
apis/ingress/v1/pomerium_types.go	Declares spec.secrets optional, exposing the incompatible empty-string handling in the settings fetcher.
cmd/ingress_opts.go	Moves leader-election flags into shared controller options while preserving their defaults.
main.go	Registers the Kubernetes bootstrap writer required by Zero-managed mode.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[all-in-one command] --> B{zero token supplied?}
    B -- No --> C[Bootstrap-managed Core]
    B -- Yes --> D[Zero-managed mode]
    D --> E[Standalone /readyz listener]
    D --> F[Zero Core entry point]
    D --> G[Ingress config controllers]
    G --> H{Sync API configured?}
    H -- Yes --> I[API reconciler with Kubernetes leader election]
    H -- No --> J[Databroker reconciler]

Loading

_{Reviews (1): Last reviewed commit: "cmd: add Zero-managed mode to all-in-one..." | Re-trigger Greptile}

[greptile-apps]

Optional secret still rejected

When a Pomerium resource omits the newly optional spec.secrets, &s.Secrets remains non-nil and optional looks up an empty name, causing settings reconciliation to repeatedly fail with resource name cannot be blank. Red test: func TestFetchConfig_AllowsOmittedBootstrapSecret(t *testing.T) { spec := icsv1.PomeriumSpec{Authenticate: new(icsv1.Authenticate), IdentityProvider: &icsv1.IdentityProvider{Secret: "pomerium/idp-secrets"}, Certificates: []string{}}; _, err := fetchConfig(t.Context(), testClient(t), spec); require.NoError(t, err) }

Context Used: For every finding, write a red test with proof and... (source)