cozystack/internal/operator
Andrei Kvapil 6576b3bb87
fix(operator): resolve namespace privileged flag by checking all Packages
Instead of using per-Package SSA field owners (which is a workaround relying
on SSA mechanics), properly resolve whether a namespace should be privileged
by iterating all PackageSources and their active Packages. A namespace gets
the privileged PodSecurity label if ANY Package has a component with
privileged: true installed in it.

This fixes the race condition where Packages sharing a namespace (e.g.
linstor and linstor-scheduler in cozy-linstor) would overwrite each other's
labels depending on reconciliation order.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
2026-02-13 17:09:12 +01:00
..
package_reconciler.go fix(operator): resolve namespace privileged flag by checking all Packages 2026-02-13 17:09:12 +01:00
packagesource_reconciler.go feat(operator): add secret replicator and reconciler improvements 2026-01-06 16:31:40 +01:00