Skip to content

Commit fdbb6fd

Browse files
IvanHuntersIvanHunters
committed
fix(harbor): mark credentials Secret with user-secret label
The Helm-managed harbor-{name}-credentials Secret was not visible through the TenantSecrets API because the lineage webhook compared the real Secret name against the rendered template "{{ .name }}-credentials" (which becomes "{name}-credentials" without the "harbor-" HelmRelease prefix), failed to match, and labelled the Secret as internal.cozystack.io/tenantresource=false. Adopt the same pattern Bucket and RabbitMQ already use: stamp the user-facing Secret with apps.cozystack.io/user-secret=true and add a matchLabels rule alongside the existing resourceNames entry in the ApplicationDefinition. The webhook now matches via labels instead of relying on Secret-name templating, so the Secret is properly marked tenantresource=true and surfaces in tenant-aware clients. Signed-off-by: IvanHunters <[email protected]>
1 parent f45facc commit fdbb6fd

2 files changed

Lines changed: 4 additions & 0 deletions

File tree

‎packages/apps/harbor/templates/harbor.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ apiVersion: v1
2727
kind: Secret
2828
metadata:
2929
name: {{ .Release.Name }}-credentials
30+
labels:
31+
apps.cozystack.io/user-secret: "true"
3032
stringData:
3133
admin-password: {{ $adminPassword | quote }}
3234
redis-password: {{ $redisPassword | quote }}

‎packages/system/harbor-rd/cozyrds/harbor.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@ spec:
3333
include:
3434
- resourceNames:
3535
- "{{ .name }}-credentials"
36+
- matchLabels:
37+
apps.cozystack.io/user-secret: "true"
3638
services:
3739
exclude: []
3840
include:

0 commit comments

Comments
 (0)