28985ed0a8
## What this PR does Fixes a race condition where multiple Packages sharing the same namespace could overwrite each other's PodSecurity Admission labels via Server-Side Apply. When two PackageSources deploy to the same namespace (e.g. `cozystack.linstor` and `cozystack.linstor-scheduler` both use `cozy-linstor`), each Package only knew about its own components. If a Package without `privileged: true` reconciled the namespace, SSA would remove the `pod-security.kubernetes.io/enforce=privileged` label set by the other Package. On Talos clusters (which default to `baseline` PodSecurity enforcement), this caused privileged pods like LINSTOR satellites to be rejected. The fix makes each Package check ALL PackageSources and their active Packages when reconciling a namespace. A namespace is set to `privileged` if ANY Package has a component with `privileged: true` in it. This ensures a consistent, holistic decision regardless of reconciliation order. ### Release note ```release-note [platform] Fixed namespace PodSecurity label race condition when multiple Packages share a namespace ``` |
||
|---|---|---|
| .. | ||
| backupcontroller | ||
| controller | ||
| cozyvaluesreplicator | ||
| fluxinstall | ||
| lineagecontrollerwebhook | ||
| operator | ||
| shared/crdmem | ||
| sse | ||
| telemetry | ||
| template | ||