feat(dgraph): add optional ACL bootstrap reconciler and post-install validation subsystem - #153
Open
mlwelles wants to merge 1 commit into
Open
feat(dgraph): add optional ACL bootstrap reconciler and post-install validation subsystem#153mlwelles wants to merge 1 commit into
mlwelles wants to merge 1 commit into
Conversation
…validation subsystem Both are default-off and inert on a stock install: nothing renders unless explicitly enabled. The ACL bootstrap reconciler is a post-install/post-upgrade hook Job that rotates groot off its default password and converges the declared users and groups. It is idempotent, so it is safe to re-run on every helm upgrade. The validation subsystem asserts the running cluster matches what the chart rendered (health, membership, ACL enforcement, admin and per-user logins, group rules, and optionally backup CronJob schedules). It can gate a release via a post-install hook Job or run on demand via helm test; a suspended manual-trigger CronJob is also provided.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add two optional, default-off subsystems: an ACL bootstrap reconciler (rotates groot off its default password, converges declarative users/groups) and a post-install validation subsystem (a
helm testPod, an optional gating hook Job, and a suspended manual-trigger CronJob). Both are absent from a stock render.Note for maintainers: these are the most opinionated pieces, deliberately at the top of the stack so they can be dropped without unwinding the rest. The reconciler guesses groot's default password on first run to rotate it; the gating Job fails
helm upgradeon a failed check (off by default).Stacked on
feat-native-tls; will retarget tomainas lower PRs merge.Part of splitting #140 into per-area PRs. The merge of all split PRs reproduces #140's tree byte-for-byte. #140 is being closed as superseded.