fix: white-label the access-request CRD from a brand name, not a DNS domain - #477
Open
ab-alien-dev wants to merge 3 commits into
Open
fix: white-label the access-request CRD from a brand name, not a DNS domain#477ab-alien-dev wants to merge 3 commits into
ab-alien-dev wants to merge 3 commits into
Conversation
…domain Kubernetes requires the CRD's API group to be *shaped* like a DNS subdomain, but never resolves it — the group isn't a domain the vendor owns, just a stable customer-facing identity slugified into that shape. The previous design took a literal DNS domain (label_domain, e.g. "acme.dev") and used it in the group verbatim (accessrequests.acme.dev), which meant any non-domain-shaped brand value (e.g. a plain project name like "test2", or a placeholder like "test2.local") produced a group the operator's own ServiceAccount was never granted RBAC for — the CRD/RBAC (rendered from the same slugified brand) and a differently-shaped runtime group request diverge. access_request_crd_names now takes a brand name and slugs it the same way regardless of whether the input already looks like a domain (acme.dev), a plain name (test2), or free text (My Cool App) — the group, RBAC, and the operator's own runtime CR-creation call all derive from the identical slug, so they can't drift.
Greptile SummaryThe PR consistently derives access-request CRD identifiers from a normalized brand slug rather than using the branding domain verbatim.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains.
|
| Filename | Overview |
|---|---|
| crates/alien-core/src/access_request_crd.rs | Centralizes slug-based access-request CRD naming and adds coverage for default, domain-shaped, and plain-text brands. |
| crates/alien-helm/src/generator.rs | Updates generated CRD and RBAC expectations to use the normalized brand-derived API group. |
| crates/alien-operator/src/cli.rs | Prefers the embedded brand for operator configuration while retaining the legacy label-domain fallback. |
Reviews (4): Last reviewed commit: "fix: update stale accessrequests.alien.d..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Contributor
Author
|
@greptile-apps review |
…perator's own CRD names The operator's own access-request-CRD naming re-derived label_domain from the embedded binary config's raw label_domain field, redundant with (and disagreeing with) the already-slugged brand field the same config carries — packages-builder computes and embeds both. When the raw value isn't already brand-shaped (e.g. a placeholder domain like "acme.local" instead of a real owned domain), the operator's runtime CR-creation call requested a group the deployed CRD/RBAC — generated from the same brand slug — was never granted, causing every access-request creation to fail with 403 Forbidden. Verified live: rebuilt+redeployed a whitelabeled operator, confirmed access-request CRs now materialize successfully and the customer approval patch (PENDING_APPROVAL -> APPROVED) round-trips correctly.
The default (unbranded) CRD group collapsed from accessrequests.alien.dev to accessrequests.alien, but this test still matched on the old string — falling through to the generic read-only assertion and failing on the access-request rule's legitimate create/update/patch verbs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
label_domain, e.g.acme.dev) and used verbatim in the group (accessrequests.acme.dev).test2, or a placeholder liketest2.local) produced a group the operator's own ServiceAccount was never granted RBAC for, causing403 Forbiddenon every access-request CR creation.access_request_crd_namesnow takes a brand name and slugs it consistently regardless of shape (acme.dev→acme,test2→test2,My Cool App→mycoolapp) — the CRD, RBAC, and the operator's own runtime CR-creation call all derive from the identical slug, so they can't drift.Test plan
cargo test -p alien-core access_request_crd— 6/6 passcargo test -p alien-helm access_request_crd_is_white_labeled— passcargo test -p alien-helm --test generator— 21/21 pass (full integration suite)403 Forbiddenon a real kind cluster against a whitelabeledtest2operator, confirmed the newbrand_sluglogic correctly slugstest2.local→test2in isolation🤖 Generated with Claude Code