Release v0.13.0 (minor)

.github/workflows/_conforma-validate.yaml

@@ -27,7 +27,7 @@ jobs:
       packages: read
     env:
       # renovate: datasource=github-releases depName=conforma/cli
-      EC_VERSION: "0.10.2"
+      EC_VERSION: "0.10.17"
     steps:
       - name: Checkout
         uses: actions/checkout@v7

.golangci.yml

@@ -0,0 +1,80 @@
+version: "2"
+
+run:
+  timeout: 5m
+
+linters:
+  default: standard
+  enable:
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - copyloopvar
+    - dogsled
+    - durationcheck
+    - errorlint
+    - gocritic
+    - gosec
+    - importas
+    - intrange
+    - loggercheck
+    - misspell
+    - modernize
+    - nakedret
+    - nilerr
+    - nolintlint
+    - prealloc
+    - revive
+    - unconvert
+    - unparam
+  settings:
+    importas:
+      no-unaliased: true
+      alias:
+        - pkg: k8s.io/api/core/v1
+          alias: corev1
+        - pkg: k8s.io/api/apps/v1
+          alias: appsv1
+        - pkg: k8s.io/api/autoscaling/v2
+          alias: autoscalingv2
+        - pkg: k8s.io/api/batch/v1
+          alias: batchv1
+        - pkg: k8s.io/api/discovery/v1
+          alias: discoveryv1
+        - pkg: k8s.io/api/networking/v1
+          alias: networkingv1
+        - pkg: k8s.io/api/policy/v1
+          alias: policyv1
+        - pkg: k8s.io/api/rbac/v1
+          alias: rbacv1
+        - pkg: k8s.io/apimachinery/pkg/api/errors
+          alias: apierrors
+        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+          alias: metav1
+        - pkg: sigs.k8s.io/gateway-api/apis/v1
+          alias: gwapiv1
+    nolintlint:
+      require-specific: true
+    revive:
+      rules:
+        - name: exported
+          disabled: true
+  exclusions:
+    generated: lax
+    rules:
+      # Test helpers construct fixtures with hardcoded values and do not need
+      # the same hardening as production code.
+      - path: _test\.go
+        linters:
+          - gosec
+
+formatters:
+  enable:
+    - gofmt
+    - goimports
+
+issues:
+  # Report everything instead of capping repeated findings (the defaults hide
+  # issues beyond 3 of the same kind, which makes CI runs non-exhaustive).
+  max-issues-per-linter: 0
+  max-same-issues: 0

AGENT.md

@@ -96,11 +96,58 @@ docs/                      Documentation
 
 ## Documentation
 
-- `README.md` is the primary user-facing doc - update when adding user-visible features
+`docs/` is user-facing reference, not design notes: 35 pages covering every CRD
+field, phase, condition and metric. Treat it as part of the API.
+
+- `README.md` is the entry point - update when adding user-visible features
 - `CONTRIBUTING.md` covers developer setup and workflow
-- `docs/` contains design docs and architecture diagrams
 - No CHANGELOG - release notes are auto-generated from commit messages by semantic-release
 
+### Documentation is part of the change, not a follow-up
+
+**Every change that alters observable behaviour updates the documentation in
+the same commit.** Not in a later pass: drift found afterwards is drift that
+shipped, and a reader cannot tell a stale sentence from a correct one.
+
+What to check, by kind of change:
+
+| Change | Update |
+|---|---|
+| CRD field added, removed or renamed | the field table in `docs/reference/<kind>.md` |
+| A `+kubebuilder:default` added or removed | the table **and** the prose around it - these have contradicted each other |
+| New or changed condition, phase, reason | the conditions table; do not document a phase the controller never sets |
+| New or removed metric | `docs/guides/monitoring.md`, including an alert rule where one makes sense |
+| Behaviour a reader would predict wrongly | the relevant `docs/concepts/` page |
+| New chart value | `values.yaml` comments, then regenerate `README.md` and `values.schema.json` |
+| Resource name, label or selector | anything in `docs/` that names it - troubleshooting commands go stale silently |
+
+### Verify rather than assume
+
+The documentation had never been checked against the code before 2026-09-03,
+and the review that followed found examples the API server rejects, three label
+selectors that match nothing, a phase no controller sets and image tags that
+cannot exist. Each was plausible on the page.
+
+Cheap checks worth running when touching docs:
+
+```bash
+# Manifests in the docs must be accepted by a real API server
+kubectl apply --dry-run=server -f <extracted-block>.yaml
+
+# Selectors must exist in internal/controller/labels.go
+grep -rn "kubectl.*-l " docs/
+
+# Fields documented for a kind must exist in its CRD, and vice versa
+ruby -ryaml -e 'd=YAML.load_file(ARGV[0]);
+  acc=[]; w=lambda{|n| next unless n.is_a?(Hash);
+    (n["properties"]||{}).each{|k,v| acc<<k; w.call(v)}; w.call(n["items"]) if n["items"]};
+  d["spec"]["versions"].each{|v| w.call(v["schema"]["openAPIV3Schema"])};
+  puts acc.uniq.sort' config/crd/bases/openvox.voxpupuli.org_servers.yaml
+```
+
+When a documented claim cannot be verified against the code, say so in the
+text rather than leaving it to look confirmed.
+
 ### Feature List Synchronization
 
 The canonical feature list lives in `docs/_snippets/features.md`.

README.md

@@ -17,7 +17,7 @@ A Kubernetes Operator that maps [OpenVox Server](https://github.com/OpenVoxProje
 - 🔄 **Multi-Version Deployments** - Run different server versions side by side - canary deployments, rolling upgrades
 - 🔒 **Rootless & OpenShift Ready** - Random UID compatible, no root, no ezbake, no privilege escalation
 - 🪶 **Minimal Image** - UBI9-based, no agent Ruby, no ezbake packaging - smaller footprint, fewer updates
-- 🧠 **Auto-tuned JVM** - Heap size calculated from memory limits (90%) - no manual `-Xmx` tuning needed
+- 🧠 **Auto-tuned JVM** - Heap derived from the pod memory limit (90%) unless `javaArgs` is set
 - 📦 **OCI Image Volumes** - Package Puppet code as OCI images, deploy immutably with automatic rollout (K8s 1.35+)
 - 🌐 **Gateway API** - SNI-based TLSRoute support - share a single LoadBalancer across environments via TLS passthrough
 - 🗄️ **Managed OpenVox DB** - Deploy OpenVox DB (PuppetDB) with external PostgreSQL - TLS, config, and credentials managed by the operator

api/v1alpha1/bool_default_test.go

@@ -5,7 +5,6 @@ import (
 	"testing"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/utils/ptr"
 )
 
 // TestDefaultedBooleansRoundTrip pins the behaviour of the optional boolean
@@ -27,7 +26,7 @@ func TestDefaultedBooleansRoundTrip(t *testing.T) {
 				ConfigRef:      "production",
 				CertificateRef: "production-cert",
 				CA:             true,
-				Server:         ptr.To(false),
+				Server:         new(false),
 			},
 		}
 		if err := k8sClient.Create(ctx, s); err != nil {
@@ -63,8 +62,8 @@ func TestDefaultedBooleansRoundTrip(t *testing.T) {
 			ObjectMeta: metav1.ObjectMeta{GenerateName: "test-config-", Namespace: "default"},
 			Spec: ConfigSpec{
 				Image:                  ImageSpec{Repository: "example.invalid/openvox-server", Tag: "latest"},
-				ReadOnlyRootFilesystem: ptr.To(false),
-				Puppet:                 PuppetSpec{Storeconfigs: ptr.To(false)},
+				ReadOnlyRootFilesystem: new(false),
+				Puppet:                 PuppetSpec{Storeconfigs: new(false)},
 			},
 		}
 		if err := k8sClient.Create(ctx, c); err != nil {
@@ -84,10 +83,10 @@ func TestDefaultedBooleansRoundTrip(t *testing.T) {
 		ca := &CertificateAuthority{
 			ObjectMeta: metav1.ObjectMeta{GenerateName: "test-ca-", Namespace: "default"},
 			Spec: CertificateAuthoritySpec{
-				AllowSubjectAltNames:         ptr.To(false),
-				AllowAuthorizationExtensions: ptr.To(false),
-				EnableInfraCRL:               ptr.To(false),
-				AllowAutoRenewal:             ptr.To(false),
+				AllowSubjectAltNames:         new(false),
+				AllowAuthorizationExtensions: new(false),
+				EnableInfraCRL:               new(false),
+				AllowAutoRenewal:             new(false),
 			},
 		}
 		if err := k8sClient.Create(ctx, ca); err != nil {

api/v1alpha1/certificateauthority_validation_test.go

@@ -9,7 +9,6 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
-	"k8s.io/utils/ptr"
 )
 
 func validCA() *CertificateAuthority {
@@ -44,7 +43,7 @@ func TestCertificateAuthorityStorageExclusivity(t *testing.T) {
 		{
 			name: "storage without external accepted",
 			mutate: func(ca *CertificateAuthority) {
-				ca.Spec.Storage = &StorageSpec{Size: ptr.To(resource.MustParse("10Gi"))}
+				ca.Spec.Storage = &StorageSpec{Size: new(resource.MustParse("10Gi"))}
 			},
 		},
 		{
@@ -57,15 +56,15 @@ func TestCertificateAuthorityStorageExclusivity(t *testing.T) {
 			name: "external with custom storage rejected",
 			mutate: func(ca *CertificateAuthority) {
 				ca.Spec.External = external
-				ca.Spec.Storage = &StorageSpec{Size: ptr.To(resource.MustParse("10Gi"))}
+				ca.Spec.Storage = &StorageSpec{Size: new(resource.MustParse("10Gi"))}
 			},
 			wantErr: "external and storage are mutually exclusive",
 		},
 		{
 			name: "external with storage at the default size rejected",
 			mutate: func(ca *CertificateAuthority) {
 				ca.Spec.External = external
-				ca.Spec.Storage = &StorageSpec{Size: ptr.To(resource.MustParse("1Gi"))}
+				ca.Spec.Storage = &StorageSpec{Size: new(resource.MustParse("1Gi"))}
 			},
 			wantErr: "external and storage are mutually exclusive",
 		},
@@ -136,15 +135,15 @@ func TestCertificateAuthorityStorageSizeValidation(t *testing.T) {
 	ctx := context.Background()
 
 	t.Run("invalid quantity rejected", func(t *testing.T) {
-		raw := &unstructured.Unstructured{Object: map[string]interface{}{
+		raw := &unstructured.Unstructured{Object: map[string]any{
 			"apiVersion": GroupVersion.String(),
 			"kind":       "CertificateAuthority",
-			"metadata": map[string]interface{}{
+			"metadata": map[string]any{
 				"generateName": "test-ca-",
 				"namespace":    "default",
 			},
-			"spec": map[string]interface{}{
-				"storage": map[string]interface{}{"size": "1Gib"},
+			"spec": map[string]any{
+				"storage": map[string]any{"size": "1Gib"},
 			},
 		}}
 		err := k8sClient.Create(ctx, raw)
@@ -159,7 +158,7 @@ func TestCertificateAuthorityStorageSizeValidation(t *testing.T) {
 
 	t.Run("valid quantity accepted", func(t *testing.T) {
 		ca := validCA()
-		ca.Spec.Storage = &StorageSpec{Size: ptr.To(resource.MustParse("500Mi"))}
+		ca.Spec.Storage = &StorageSpec{Size: new(resource.MustParse("500Mi"))}
 		if err := k8sClient.Create(ctx, ca); err != nil {
 			t.Fatalf("a valid quantity must be accepted, got: %v", err)
 		}

api/v1alpha1/javaargs_default_test.go

@@ -0,0 +1,36 @@
+package v1alpha1
+
+import (
+	"context"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// TestServerJavaArgsHasNoDefault is the test that was missing while the bug
+// existed. The unit tests around resolveJavaArgs all call the function
+// directly and therefore pass whether or not the field can ever be empty; only
+// a round-trip through the API server shows that.
+//
+// A default here is not cosmetic: the controller derives the heap from the
+// pod's memory limit exactly when javaArgs is empty, so a default silently
+// pins every Server to the same heap.
+func TestServerJavaArgsHasNoDefault(t *testing.T) {
+	ctx := context.Background()
+
+	server := &Server{
+		ObjectMeta: metav1.ObjectMeta{GenerateName: "test-server-", Namespace: "default"},
+		Spec: ServerSpec{
+			ConfigRef:      "production",
+			CertificateRef: "production-cert",
+		},
+	}
+	if err := k8sClient.Create(ctx, server); err != nil {
+		t.Fatalf("creating Server: %v", err)
+	}
+	t.Cleanup(func() { _ = k8sClient.Delete(ctx, server) })
+
+	if server.Spec.JavaArgs != "" {
+		t.Errorf("javaArgs must come back empty so the heap can be derived, got %q", server.Spec.JavaArgs)
+	}
+}

api/v1alpha1/server_types.go

@@ -82,7 +82,11 @@ type ServerSpec struct {
 	Resources corev1.ResourceRequirements `json:"resources,omitempty"`
 
 	// JavaArgs defines the JVM arguments.
-	// +kubebuilder:default="-Xms512m -Xmx1024m"
+	//
+	// There is deliberately no default. A defaulted field is never empty, and
+	// the controller uses emptiness to decide whether to derive the heap from
+	// the pod's memory limit. With a default in place that derivation is dead
+	// code and every Server runs on the same heap regardless of its limit.
 	// +optional
 	JavaArgs string `json:"javaArgs,omitempty"`
 

api/v1alpha1/signingpolicy_types.go

@@ -41,15 +41,42 @@ type SigningPolicySpec struct {
 	// +optional
 	Any bool `json:"any,omitempty"`
 
-	// Pattern defines certname glob matching rules.
+	// Certnames defines allowed certname glob patterns. The certname must match
+	// at least one.
 	// +optional
-	Pattern *PatternSpec `json:"pattern,omitempty"`
+	Certnames *PatternSpec `json:"certnames,omitempty"`
 
-	// DNSAltNames defines allowed DNS subject alternative name patterns.
-	// If not set and Any is false, CSRs with SANs are denied by the autosign binary.
+	// DNSAltNames defines allowed DNS subject alternative name patterns (glob).
+	// If a CSR carries DNS SANs and this is not set, the CSR is denied.
 	// +optional
 	DNSAltNames *PatternSpec `json:"dnsAltNames,omitempty"`
 
+	// IPAltNames defines allowed IP subject alternative names as CIDR ranges
+	// (e.g. "10.0.0.0/16", "::1/128"). If a CSR carries IP SANs and this is not
+	// set, the CSR is denied.
+	// +optional
+	IPAltNames *PatternSpec `json:"ipAltNames,omitempty"`
+
+	// URIAltNames defines allowed URI subject alternative name patterns. A "*"
+	// wildcard matches any run of characters, including "/". If a CSR carries URI
+	// SANs and this is not set, the CSR is denied.
+	// +optional
+	URIAltNames *PatternSpec `json:"uriAltNames,omitempty"`
+
+	// EmailAltNames defines allowed email subject alternative name patterns. A "*"
+	// wildcard matches any run of characters, including "@". If a CSR carries email
+	// SANs and this is not set, the CSR is denied.
+	// +optional
+	EmailAltNames *PatternSpec `json:"emailAltNames,omitempty"`
+
+	// Extensions lists Puppet CSR extension names (e.g. pp_cli_auth) that a CSR
+	// matched by this policy is permitted to carry. Privileged authorization
+	// extensions (the 1.3.6.1.4.1.34380.1.3 arc: pp_cli_auth, pp_authorization,
+	// pp_auth_token) are denied unless listed here; this gate applies to every
+	// policy, including one with any=true. Trusted-fact extensions are unaffected.
+	// +optional
+	Extensions *PatternSpec `json:"extensions,omitempty"`
+
 	// CSRAttributes defines CSR extension attributes that must all match (AND logic).
 	// Each entry specifies an attribute name and the expected value (inline or from a Secret).
 	// +optional