v0.4.0

zaentrum-operator v0.4.0

Images: ghcr.io/zaentrum/operator:v0.4.0, ghcr.io/zaentrum/operator:0.4, ghcr.io/zaentrum/admin:v0.4.0, ghcr.io/zaentrum/admin:0.4, ghcr.io/zaentrum/keycloak:v0.4.0, ghcr.io/zaentrum/keycloak:0.4, ghcr.io/zaentrum/appliance:v0.4.0, ghcr.io/zaentrum/appliance:0.4, ghcr.io/zaentrum/operator-bundle:v0.4.0, ghcr.io/zaentrum/operator-bundle:0.4, ghcr.io/zaentrum/operator-catalog:v0.4.0, ghcr.io/zaentrum/operator-catalog:0.4.

175 commits since v0.3.0 (compare):

• chart: portal-api manages people and chino-api deletes accounts, bundled identity only (3ad037e)
• chart: a person's rating cap, max_rating, for admins only and in the viewers' tokens (8af6103)
• chart: zaentrum-people, the realm's client for managing people and nothing else (58297ef)
• chart: the platform's certificate on the Ingress and the Routes, and from cert-manager (8b639d2)
• chart: the bundled Postgres backed up into the claim backups, and restored from a dump (f478f80)
• chart: the media pipeline on the GPU or the CPU, its ladder and packaging from the CR (5f03c6f)
• chart: the realm Job keeps how the platform's clients sign in, and makes one the realm lacks (842817e)
• chart: a bundled install tells the TV and phone apps its realm's clients (51844c7)
• chart: the realm's admin role and service client describe the platform as it is (ead02f7)
• chart: katalog-manager-api is told about no download client (3a2e9f9)
• chart: portal admin clients on a shared realm, chino-stream ready only with an AAC encoder (25780b2)
• chart: the demo profile's Postgres runs on an emptyDir, as the demo's does (7cb14c9)
• chart: the realm Job retires the demo user's placeholder password (e7bf916)
• chart: the bundled Postgres keeps its data on a claim, and moves only by a copy (7a9fe93)
• chart: the admin console answers through a port-forward, unless published (93d3202)
• chart: a hook Job writes the platform's sign-in redirects into a realm that exists (c359b71)
• chart: the realm's clients return only to the platform's own origins (ba01289)
• chart: a plain Helm install makes its own Secrets, random, and keeps them (3a92ae0)
• chart: the media claim the chart creates fits any cluster (912ef4d)
• chart: every pod names a numeric user, except where OpenShift names it (25b9520)
• chart: Keycloak's Service takes the address its cluster gives it (63c72c8)
• chart: the platform's checks, as a chart test (38004bb)
• chart: track the dev secrets template the gitignore was hiding (19ea431)
• chart: portal-api may only create Secrets (a3d32ba)
• chart: chino-api PORTAL_BASE_URL for the extension seam + render test asserting core carries no acquisition vocabulary (5439157)
• chart: pass CHINO_PUBLIC_URL to portal-api in subdomain routing (fc99e03)
• chart: OIDC_CLIENT_ID_PORTAL — zaentrum-web bundled, identity.clientId external (5382c72)
• chart: identity.clientId drives OIDC_CLIENT_ID_WEB (/api/config for both SPAs); gate the bundled-keycloak /auth route on identity.mode=bundled (caf83c8)
• chart: external-identity worker OIDC — token endpoint from the issuer + zaentrum-worker-oidc client secret (mirrors prod's katalog-oidc); bundled render byte-identical (3d54400)
• chart: wire chino-api to the bus (KAFKA_BROKERS) for the live-refresh SSE bridge (ce673c6)
• chart: items.metadataLocked column (manual-edit lock) + idempotent upgrade ALTER (f700b9f)
• chart: wire portal-api to KAFKA_BROKERS for the event console (f960e23)
• chart: grant portal-api pods/log (for the Logs console) (565575c)
• chart: drop the duplicate katalog-manage-ui deployment (b495c5f)
• chart: wire catalog pipeline Kafka env into the workers (d56b707)
• chart: second katalog UI deployment for the Catalog Management app (cc040a9)
• docs: people, the rating cap and Secret zaentrum-people in the operator README (d25b0ed)
• docs: releases — a tag across the platform, stable on the newest, edge on latest (d5ca21c)
• docs: CONTRIBUTING, apps/, platform/ and the bundle README describe the repository as it is (0fb9f2d)
• docs: turning the appliance's pipeline off takes deleting its workers (83cf79d)
• docs: the repository layout as it is, and scope and license linked to the front door (3250442)
• docs: both release channels point at latest, and an install on latest rolls every push (771cad1)
• docs: the route map and the products are those the chart renders (36ca040)
• docs: a cluster installs the operator from its pinned manifest; deploy/base is not supported (843d170)
• docs: the appliance pulls its images whenever their pods start; there is no airgap mode (237f8b1)
• docs: the appliance's Postgres starts on a claim, and replacing the container starts an empty platform (2c5e4f7)
• docs: identity is bundled or external, and accounts are made in Keycloak's console (c389552)
• docs: phones and TVs sign in over https only; the appliance serves this machine (bbe9abf)
• docs: there is no setup wizard; first run is a sign-in, a TMDB key and the library (5886e7f)
• docs: the appliance answers on port 80 as zaentrum.localhost, and boots the operator (86c7463)
• docs: reaching the admin console on a cluster and on the appliance (86378ae)
• docs: a claim for the bundled Postgres where nothing provisions one (20582d2)
• docs: the realm Job retires the demo user's placeholder password (40d2e1a)
• docs: the platform's Secrets, its database's volume, sign-in redirects, the admin console (a57939e)
• docs: what status.verification says, and when the platform checks itself (e90bba9)
• docs: what status.controller says, and why it is only a reading (5fece73)
• docs: leave a pointer stub (docs moved to the zaentrum front-door repo) (f4f7393)
• docs: move deployment docs to the zaentrum front-door repo (c73030f)
• docs: scrub internal infra from the public deploy docs (bb122c7)
• docs: comprehensive deployment documentation (465785a)
• controller: Secret zaentrum-people, made once, for the People page (1e918f7)
• controller: stable runs its release, and a push to main moves only edge (e7fc8a3)
• controller: an issuer named outright is its own scheme, for the TLS condition (f40c81a)
• controller: the platform's certificate to the Routes, and a TLS condition that says how the hosts are served (aadf601)
• controller: backups reported from their runs, and a restore the operator stops the clients for (2bf3414)
• controller: read the Zaentrum from the API server, not the cache (bf05e58)
• controller: a verification run in flight is never replaced, and a replaced one is followed (47c8243)
• controller: switch the bundled Postgres onto its claim with a patch, then apply (4a0841e)
• controller: read the running Postgres uncached before deciding where its data is (d012f25)
• controller: keep the bundled Postgres where it runs, and move it only by a copy (ed2d378)
• controller: a realm run and a verification run never overlap (486a913)
• controller: bring the bundled realm in step with the platform, once per change (3c13f8b)
• controller: make each platform Secret once, from crypto/rand, and keep it (89444d9)
• controller: read its own pod straight from the API server (6678842)
• controller: verify the platform after every update, and say so in status (8e8c73b)
• controller: read the running pod and say what this operator is (b019808)
• controller: collect values Secrets nothing reads any more (99368d6)
• controller: keep an addon's values on removal behind a finalizer (5d7770f)
• controller: enforce the addon value + guardrail restrictions (0209f82)
• controller: install ZaentrumAddon charts next to the platform (797aa06)
• deploy: pin the operator that manages people and follows the release channels (b4ad421)
• deploy: a release's appliance pins its operator and its platform; main's boots edge (f5ce3d5)
• deploy: pin the operator that runs the pipeline on CPU, backs up and serves TLS (f7f6553)
• deploy: the appliance's Dockerfile, build.sh, entrypoint and workflows say what they do (dad5c5d)
• deploy: base and compose ship no credentials and refuse to start without them, marked unsupported (6a9cd10)
• deploy: the appliance runs the media pipeline, on the CPU (78db5a3)
• deploy: pin the operator that generates the platform's secrets (9b34534)
• deploy: pin the operator that reads its own pod uncached (e9d73a1)
• deploy: pin the operator the appliance boots and verifies with (4e641ae)
• deploy: pin the operator that verifies the platform after every update (a377be2)
• deploy: pin the operator that reports its own controller (ad7d289)
• deploy: pin the operator image that installs addon charts (2040c65)
• deploy: ZaentrumAddon CRD and ClusterRole in the install bundles (fb150f8)
• deploy: align images to flat ghcr.io/zaentrum/; build only platform-owned images (d1419ac)
• api: spec.tls — the platform's own certificate, a Secret or one cert-manager issues (b868e56)
• api: spec.backup and status.backup — backups of the bundled Postgres, and its restore (787c1eb)
• api: spec.pipeline — how the media pipeline encodes and packages (43ee2ac)
• api: spec.identity.tvClientId and mobileClientId — the clients the TV and phone apps sign in through (5a6f9a8)
• api: spec.storage.postgres — where the bundled Postgres keeps its data (9b40902)
• api: spec.identity.exposeAdminConsole — the admin console is off the public host (8d11b93)
• api: spec.verification and status.verification — the platform checks itself (5bae4da)
• api: status.controller — the operator's own control plane (236de59)
• api: drop spec.inputsRevision (d9e19fa)
• api: ZaentrumAddon v1alpha1 (13577b4)
• operator: drop internal/templates/data, which nothing reads, and the README that described it (3fd08e0)
• operator: ride out API blips instead of restarting (54ac511)
• operator: digest-pin platform images so a moving tag actually rolls (aa42c0a)
• operator: pin install to sha-e5571da (shared-services chart profiles + updated CRD) (3b75ef7)
• operator: pin install to sha-ce673c6 (chino-api KAFKA_BROKERS) (310fc04)
• operator: pin install to sha-f700b9f (metadataLocked schema) (5ecdc21)
• operator: correct the install pin to sha-0f95e64 (188e2cb's image build was superseded by CI concurrency) (4dbab75)
• operator: pin install to sha-188e2cb (restores the /katalog-manage console) (0f95e64)
• operator: bump pinned image to sha-f960e233 (portal-api KAFKA_BROKERS for the event console) (83a233a)
• operator: grant routes/custom-host + pin install to the new chart image (6aa0fc2)
• other: Pin the operator image to the leader-election build (7c1d4f2)
• other: pin operator sha-5439157 (chino-api PORTAL_BASE_URL extension seam) (d7e88c2)
• other: pin operator sha-fc99e03 (CHINO_PUBLIC_URL for subdomain routing) (d65e64d)
• other: pin operator sha-5382c72 (OIDC_CLIENT_ID_PORTAL) (3528f71)
• other: pin operator sha-caf83c8 (clientId -> /api/config; /auth route gated to bundled identity) (9c39ba0)
• other: pin operator sha-f0aeb60 (external-identity worker OIDC + portal-api Role grant RBAC) (f670b77)
• other: Revert "chart: drop the duplicate katalog-manage-ui deployment" (188e2cb)
• other: Add the canonical platform Helm chart (Phase 1 — one source of truth) (7009868)
• other: Rename the operator identity stube→zaentrum + add per-service replica control (bca9675)
• ci: a release tag builds its appliance, and boots it once the release's images exist (04585c3)
• ci: a release tag builds the platform-owned images as vX.Y.Z and X.Y (1822c22)
• ci: the catalog image's tags are a list, not one string with spaces (fad0e28)
• ci: the operator catalog names its channel head, and says when it cannot (1da7542)
• ci: boot the appliance, and require the platform's check of itself to pass (79a701e)
• ci: the neutrality guard failed its own introducing commit — fix the comment (4533b28)
• ci: build the neutrality guard the strategy said was already enforced (22b74da)
• operator install: pin to sha-565575c (portal-api pods/log grant) (ee374c1)
• operator install: pin to the de-duplicated chart image (sha-b495c5f) (d057e14)
• operator install: pin to the kafka-persistence chart image (sha-4158b33) (89e8eb9)
• operator install: pin to the pipeline-kafka-env chart image (8f38d0f)
• operator install: pin to the realm-fix chart image (sub mapper) (515c8aa)
• operator install: pin the real image tag (sha-, not short sha) (b4c504f)
• operator install: add Routes RBAC + assemble the cluster-admin bootstrap (0f46da5)
• addon: refuse rendered names under zaentrum-addon- (fe4b129)
• addon: add spec.inputsRevision; drop the unwritten Pending phase (8ae32cd)
• addon: close value-leak, confused-deputy, guardrail and SSRF gaps (ea78892)
• addon: keep finished Jobs instead of running them again (b9a8226)
• addon: fetch, layer values, render and guard addon charts (69e511c)
• rbac: the operator manages the platform's cert-manager Certificate (adddf1f)
• rbac: the operator manages the backups' CronJob (9828825)
• rbac: operator holds zaentrumaddons; portal-api manages addons (2d33857)
• rbac: record why the operator SA must never carry a pull secret (07bc6eb)
• allinone: call kubectl, which the k3s image ships, not "k3s kubectl" (1d099f4)
• allinone: resolve the public host to the ingress, as a browser does (b2c891b)
• allinone: re-render the baked operator install from operator/config (984476c)
• bundle: a release tag stamps its version into the CSV, the bundle and the catalog (ce80ee1)
• bundle: show the admin console switch and the database's move on OperatorHub (26ac186)
• bundle: show the verification verdict, and its switch, on OperatorHub (c88785a)
• fix(chart): ship catalog search, so every environment has it (0078798)
• fix(chart): stop advertising two OIDC client ids that do not work (f5c4919)
• fix(chart): point MEDIA_ROOT at the directory content actually lives in (4192457)
• templates: no Helm hook is applied with the platform, tests or not (9bb4748)
• templates: derive addon platform values from the chart's own helpers (b9572b3)
• templates: gofmt the render test (1085b37)
• realm: ship the zaentrum-addon role — addon self-registration on a stock install (ece0584)
• realm: emit sub claim (add oidc-sub-mapper to the profile scope) (cdbbc4e)
• updates: a manual install keeps what it runs, and a new one starts on the channel's release (515279d)
• updates: the channel document is the front door's releases.json (c77be1c)
• bundled realm: a client for the command line, with the device grant (17f6728)
• chart+cr: shared-services profiles — external Kafka/Postgres + chino subdomain routing (e5571da)
• feat: optional persistent volume for the bundled Kafka broker (4158b33)
• feat(operator): a stalled rollout is Degraded, not Progressing (79633ff)
• fix operator image build: COPY platform/ (embedded chart) in Dockerfile (5909859)
• install: hand the controller the downward API, and let the appliance say so (ba3fd28)
• operator rbac: hold pods(+log) + deployments/scale so the portal-api Role can be CREATED in a fresh namespace (escalation check; demo's pre-existing Role masked it) (f0aeb60)
• phase 2: the operator renders the canonical chart via the Helm engine (b7c0c96)
• release: a tag publishes the GitHub release with the release's operator install (0435451)
• rename: nalet/stube -> zaentrum/stube (org move to github.com/zaentrum) (f823e33)
• repo: make this the platform meta-repo + drop the stube module name (1d1579c)
• scripts: the neutrality guard reads a name joined by "_" as a name, and checks its own patterns first (c697ce4)
• verification: check with zae:latest when no zae image carries the platform's tag (f6729ac)