DevFW-CICD/poc-core-deploy
Watch
21
0
Fork
You've already forked poc-core-deploy
 0
Code Issues 1 Pull requests 9 Projects Releases Packages Wiki Activity Actions

fix(tenant-controller): correct ClusterRoleBinding roleRef and subject #47

Open
Daniel.Sy wants to merge 1 commit from ipceicis-9690-deploy-blocker-fixes into main
pull from: ipceicis-9690-deploy-blocker-fixes
merge into: DevFW-CICD:main
Conversation 2 Commits 1 Files changed 1 +2 -2
Daniel.Sy commented 2026-07-13 17:52:59 +00:00
Owner
Copy link

Summary

Fixes a two-line RBAC error in edge-connect-kcp-controllers-tenant/manifests/tenant-controller-rbac.yaml that prevented the tenant-controller from acquiring its permissions.

Changes

File: edge-connect-kcp-controllers-tenant/manifests/tenant-controller-rbac.yaml

  • roleRef.name: removed duplicate leading e — eedge-connect-tenant-cm-tenant-controller → edge-connect-tenant-cm-tenant-controller. The corrected name now matches the ClusterRole defined in the same manifest.
  • subjects[0].name: replaced wrong OPA subject tenant-cm-opa-data-controller with the correct tenant-controller subject tenant-cm-tenant-controller.

Validation

roleRef.name now exactly matches the ClusterRole metadata name (edge-connect-tenant-cm-tenant-controller) defined in the same file, satisfying Kubernetes' immutability constraint on roleRef.

Closes IPCEICIS-9690

## Summary Fixes a two-line RBAC error in `edge-connect-kcp-controllers-tenant/manifests/tenant-controller-rbac.yaml` that prevented the tenant-controller from acquiring its permissions. ## Changes **File:** `edge-connect-kcp-controllers-tenant/manifests/tenant-controller-rbac.yaml` - **`roleRef.name`**: removed duplicate leading `e` — `eedge-connect-tenant-cm-tenant-controller` → `edge-connect-tenant-cm-tenant-controller`. The corrected name now matches the `ClusterRole` defined in the same manifest. - **`subjects[0].name`**: replaced wrong OPA subject `tenant-cm-opa-data-controller` with the correct tenant-controller subject `tenant-cm-tenant-controller`. ## Validation `roleRef.name` now exactly matches the `ClusterRole` metadata name (`edge-connect-tenant-cm-tenant-controller`) defined in the same file, satisfying Kubernetes' immutability constraint on `roleRef`. --- Closes IPCEICIS-9690
- Fix typo in ClusterRoleBinding roleRef: eedge-connect-tenant-cm-tenant-controller
  → edge-connect-tenant-cm-tenant-controller
- Fix RBAC subject: tenant-cm-opa-data-controller → tenant-cm-tenant-controller
- Replace all CHANGE_ME / CHANGEME / tobedefined identity placeholders with
  deterministic dev-local values across all *-values-dev.yaml / *-values-local.yaml
- Correct identityHash values to actual sha256(identity.value) strings
  (tenantpolicies, tenants, workspaces, clusters, users, ssoconfigs,
   tenancy.kcp.io, topology.kcp.io)
- Add hack/validate-identity-hashes.sh: static validator for hash ↔ value
  consistency and placeholder scan (macOS + Linux compatible)
- Add `make validate` target: runs validate-identity-hashes.sh + helm lint

Ref: IPCEICIS-9690
manuel.ganter reviewed 2026-07-14 09:37:06 +00:00
tenant-cm-tenant-controller-apiexport-values-dev.yaml Outdated
@ -18,3 +17,3 @@
# Dev/local identity: stable, deterministic, not a secret.
identity:
enabled: true
value: "edge-connect-tenants-identity-CHANGE_ME"
manuel.ganter commented 2026-07-14 09:37:06 +00:00
Owner
Copy link

please dont change the identities if you really dont want to change every identity hash in the app

please dont change the identities if you really dont want to change every identity hash in the app
👍 1
Daniel.Sy force-pushed ipceicis-9690-deploy-blocker-fixes from 0a3b54e91a to f6cb215d13 2026-07-20 09:21:23 +00:00 Compare
Patrick.Sy approved these changes 2026-07-22 13:21:37 +00:00
Daniel.Sy changed title from fix: resolve local deploy RBAC and identity blockers to fix(tenant-controller): correct ClusterRoleBinding roleRef and subject 2026-07-24 15:49:12 +00:00
Daniel.Sy force-pushed ipceicis-9690-deploy-blocker-fixes from f6cb215d13 to 6d17830982 2026-07-27 12:35:10 +00:00 Compare
This pull request has changes conflicting with the target branch.
  • workspaces/controllers-tenant/tenant-controller-rbac.yaml
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin ipceicis-9690-deploy-blocker-fixes:ipceicis-9690-deploy-blocker-fixes
git switch ipceicis-9690-deploy-blocker-fixes

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff ipceicis-9690-deploy-blocker-fixes
git switch ipceicis-9690-deploy-blocker-fixes
git rebase main
git switch main
git merge --ff-only ipceicis-9690-deploy-blocker-fixes
git switch ipceicis-9690-deploy-blocker-fixes
git rebase main
git switch main
git merge --no-ff ipceicis-9690-deploy-blocker-fixes
git switch main
git merge --squash ipceicis-9690-deploy-blocker-fixes
git switch main
git merge --ff-only ipceicis-9690-deploy-blocker-fixes
git switch main
git merge ipceicis-9690-deploy-blocker-fixes
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Patrick.Sy
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
DevFW-CICD/poc-core-deploy!47
No description provided.