Repository navigation
[Backport release-1.7] fix(marketplace): do not install a connected repository's components on connect - #5117
Merged
Conversation
…on connect Connecting a marketplace repository materialized its PackageSources and then auto-created a tap-managed Package per source. The Package reconciler installed a HelmRelease for every install-marked component of the default variant, which Flux runs under its cluster-admin service account with no impersonation. A publisher's install chart therefore ran as cluster-admin on connect, with no operator step, contradicting the documented behaviour that tapping installs nothing. Remove the on-connect auto-registration. Connecting now only materializes PackageSources; installing an app is an explicit cozypkg add (or dashboard action), which is the sole remaining creator of a Package. This also stops a Package the admin removed with cozypkg del from being re-created on the next source revision. Catalog population from PackageSource metadata without an install is left to the long-term design in #4359, and the privileged-confirmation gaps #4358 and #4359 stay open. Assisted-by: LLM Signed-off-by: IvanHunters <[email protected]> (cherry picked from commit 3fa534f)
Removing on-connect auto-registration made several user-facing and doc texts wrong: they promised that tapping registers a repository's apps in the catalog and runs its charts. Tapping now installs nothing, so the texts told operators to wait for apps that never appear. Reword the `cozypkg tap`/`untap` help, the tap success output (now printing a `cozypkg add <name>` line per materialized PackageSource), the `cozypkg init` scaffold README, the packages-index trust model, the dashboard Repositories banner and per-repository empty state, and the stale re-registration code comments. No behaviour changes beyond the added `cozypkg add` hint in the tap output. Assisted-by: LLM Signed-off-by: IvanHunters <[email protected]> (cherry picked from commit 2f39e30)
github-actions
Bot
requested review from
IvanHunters,
Andrei Kvapil (kvaps),
Aleksei Sviridkin (lexfrei),
Timofei Larkin (lllamnyp),
mattia-eleuteri,
myasnikovdaniil and
Kirill Ilin (sircthulhu)
as code owners
October 26, 2026 16:11
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Backport of #5071 to
release-1.7.