v0.4.0

zaentrum-operator v0.4.0

Images: ghcr.io/zaentrum/operator:v0.4.0, ghcr.io/zaentrum/operator:0.4, ghcr.io/zaentrum/admin:v0.4.0, ghcr.io/zaentrum/admin:0.4, ghcr.io/zaentrum/keycloak:v0.4.0, ghcr.io/zaentrum/keycloak:0.4, ghcr.io/zaentrum/appliance:v0.4.0, ghcr.io/zaentrum/appliance:0.4, ghcr.io/zaentrum/operator-bundle:v0.4.0, ghcr.io/zaentrum/operator-bundle:0.4, ghcr.io/zaentrum/operator-catalog:v0.4.0, ghcr.io/zaentrum/operator-catalog:0.4.

175 commits since v0.3.0 (compare):

• chart: portal-api manages people and chino-api deletes accounts, bundled identity only (3ad037e)
• chart: a person's rating cap, max_rating, for admins only and in the viewers' tokens (8af6103)
• chart: zaentrum-people, the realm's client for managing people and nothing else (58297ef)
• chart: the platform's certificate on the Ingress and the Routes, and from cert-manager (8b639d2)
• chart: the bundled Postgres backed up into the claim backups, and restored from a dump (f478f80)
• chart: the media pipeline on the GPU or the CPU, its ladder and packaging from the CR (5f03c6f)
• chart: the realm Job keeps how the platform's clients sign in, and makes one the realm lacks (842817e)
• chart: a bundled install tells the TV and phone apps its realm's clients (51844c7)
• chart: the realm's admin role and service client describe the platform as it is (ead02f7)
• chart: katalog-manager-api is told about no download client (3a2e9f9)
• chart: portal admin clients on a shared realm, chino-stream ready only with an AAC encoder (25780b2)
• chart: the demo profile's Postgres runs on an emptyDir, as the demo's does (7cb14c9)
• chart: the realm Job retires the demo user's placeholder password (e7bf916)
• chart: the bundled Postgres keeps its data on a claim, and moves only by a copy (7a9fe93)
• chart: the admin console answers through a port-forward, unless published (93d3202)
• chart: a hook Job writes the platform's sign-in redirects into a realm that exists (c359b71)
• chart: the realm's clients return only to the platform's own origins (ba01289)
• chart: a plain Helm install makes its own Secrets, random, and keeps them (3a92ae0)
• chart: the media claim the chart creates fits any cluster (912ef4d)
• chart: every pod names a numeric user, except where OpenShift names it (25b9520)
• chart: Keycloak's Service takes the address its cluster gives it (63c72c8)
• chart: the platform's checks, as a chart test (38004bb)
• chart: track the dev secrets template the gitignore was hiding (19ea431)
• chart: portal-api may only create Secrets (a3d32ba)
• chart: chino-api PORTAL_BASE_URL for the extension seam + render test asserting core carries no acquisition vocabulary (5439157)
• chart: pass CHINO_PUBLIC_URL to portal-api in subdomain routing (fc99e03)
• chart: OIDC_CLIENT_ID_PORTAL — zaentrum-web bundled, identity.clientId external (5382c72)
• chart: identity.clientId drives OIDC_CLIENT_ID_WEB (/api/config for both SPAs); gate the bundled-keycloak /auth route on identity.mode=bundled (caf83c8)
• chart: external-identity worker OIDC — token endpoint from the issuer + zaentrum-worker-oidc client secret (mirrors prod's katalog-oidc); bundled render byte-identical (3d54400)
• chart: wire chino-api to the bus (KAFKA_BROKERS) for the live-refresh SSE bridge (ce673c6)
• chart: items.metadataLocked column (manual-edit lock) + idempotent upgrade ALTER (f700b9f)
• chart: wire portal-api to KAFKA_BROKERS for the event console (f960e23)
• chart: grant portal-api pods/log (for the Logs console) (565575c)
• chart: drop the duplicate katalog-manage-ui deployment (b495c5f)
• chart: wire catalog pipeline Kafka env into the workers (d56b707)
• chart: second katalog UI deployment for the Catalog Management app (cc040a9)
• docs: people, the rating cap and Secret zaentrum-people in the operator README (d25b0ed)
• docs: releases — a tag across the platform, stable on the newest, edge on latest (d5ca21c)
• docs: CONTRIBUTING, apps/, platform/ and the bundle README describe the repository as it is (0fb9f2d)
• docs: turning the appliance's pipeline off takes deleting its workers (83cf79d)
• docs: the repository layout as it is, and scope and license linked to the front door (3250442)
• docs: both release channels point at latest, and an install on latest rolls every push (771cad1)
• docs: the route map and the products are those the chart renders (36ca040)
• docs: a cluster installs the operator from its pinned manifest; deploy/base is not supported (843d170)
• docs: the appliance pulls its images whenever their pods start; there is no airgap mode (237f8b1)
• docs: the appliance's Postgres starts on a claim, and replacing the container starts an empty platform (2c5e4f7)
• docs: identity is bundled or external, and accounts are made in Keycloak's console (c389552)
• docs: phones and TVs sign in over https only; the appliance serves this machine (bbe9abf)
• docs: there is no setup wizard; first run is a sign-in, a TMDB key and the library (5886e7f)
• docs: the appliance answers on port 80 as zaentrum.localhost, and boots the operator (86c7463)
• docs: reaching the admin console on a cluster and on the appliance (86378ae)
• docs: a claim for the bundled Postgres where nothing provisions one (20582d2)
• docs: the realm Job retires the demo user's placeholder password (40d2e1a)
• docs: the platform's Secrets, its database's volume, sign-in redirects, the admin console (a57939e)
• docs: what status.verification says, and when the platform checks itself (e90bba9)
• docs: what status.controller says, and why it is only a reading (5fece73)
• docs: leave a pointer stub (docs moved to the zaentrum front-door repo) (f4f7393)
• docs: move deployment docs to the zaentrum front-door repo (c73030f)
• docs: scrub internal infra from the public deploy docs (bb122c7)
• docs: comprehensive deployment documentation (465785a)
• controller: Secret zaentrum-people, made once, for the People page (1e918f7)
• controller: stable runs its release, and a push to main moves only edge (e7fc8a3)
• controller: an issuer named outright is its own scheme, for the TLS condition (f40c81a)
• controller: the platform's certificate to the Routes, and a TLS condition that says how the hosts are served (aadf601)
• controller: backups reported from their runs, and a restore the operator stops the clients for (2bf3414)
• controller: read the Zaentrum from the API server, not the cache (bf05e58)
• controller: a verification run in flight is never replaced, and a replaced one is followed (47c8243)
• controller: switch the bundled Postgres onto its claim with a patch, then apply (4a0841e)
• controller: read the running Postgres uncached before deciding where its data is (d012f25)
• controller: keep the bundled Postgres where it runs, and move it only by a copy (ed2d378)
• controller: a realm run and a verification run never overlap (486a913)
• controller: bring the bundled realm in step with the platform, once per change (3c13f8b)
• controller: make each platform Secret once, from crypto/rand, and keep it (89444d9)
• controller: read its own pod straight from the API server (6678842)
• controller: verify the platform after every update, and say so in status (8e8c73b)
• controller: read the running pod and say what this operator is (b019808)
• controller: collect values Secrets nothing reads any more (99368d6)
• controller: keep an addon's values on removal behind a finalizer (5d7770f)
• controller: enforce the addon value + guardrail restrictions (0209f82)
• controller: install ZaentrumAddon charts next to the platform (797aa06)
• deploy: pin the operator that manages people and follows the release channels (b4ad421)
• deploy: a release's appliance pins its operator and its platform; main's boots edge (f5ce3d5)
• deploy: pin the operator that runs the pipeline on CPU, backs up and serves TLS (f7f6553)
• deploy: the appliance's Dockerfile, build.sh, entrypoint and workflows say what they do (dad5c5d)
• deploy: base and compose ship no credentials and refuse to start without them, marked unsupported (6a9cd10)
• deploy: the appliance runs the media pipeline, on the CPU (78db5a3)
• deploy: pin the operator that generates the platform's secrets (9b34534)
• deploy: pin the operator that reads its own pod uncached (e9d73a1)
• deploy: pin the operator the appliance boots and verifies with (4e641ae)
• deploy: pin the operator that verifies the platform after every update (a377be2)
• deploy: pin the operator that reports its own controller (ad7d289)
• deploy: pin the operator image that installs addon charts (2040c65)
• deploy: ZaentrumAddon CRD and ClusterRole in the install bundles (fb150f8)
• deploy: align images to flat ghcr.io/zaentrum/; build only platform-owned images (d1419ac)
• api: spec.tls — the platform's own certificate, a Secret or one cert-manager issues (b868e56)
• api: spec.backup and status.backup — backups of the bundled Postgres, and its restore (787c1eb)
• api: spec.pipeline — how the media pipeline encodes and packages (43ee2ac)
• api: spec.identity.tvClientId and mobileClientId — the clients the TV and phone apps sign in through (5a6f9a8)
• api: spec.storage.postgres — where the bundled Postgres keeps its data (9b40902)
• api: spec.identity.exposeAdminConsole — the admin console is off the public host (8d11b93)
• api: spec.verification and status.verification — the platform checks itself (5bae4da)
• api: status.controller — the operator's own control plane (236de59)
• api: drop spec.inputsRevision (...