Skip to content

Commit e14636d

Browse files
lexfreilexfrei
committed
chore: drop private cluster, host and personal names from the tree
Private infrastructure names, a real hostname, a commented-out internal mirror block, an internal product name, and a reviewer's name in a comment do not belong in a public repository; drop them and replace what needs a stand-in with neutral placeholders. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent a5d12e7 commit e14636d

18 files changed

Lines changed: 47 additions & 70 deletions

File tree

‎api/backups/strategy/v1alpha1/etcd_types.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -107,8 +107,8 @@ type EtcdTemplate struct {
107107
// Until the upstream gains symmetric semantics (or surfaces the final
108108
// file path via the equivalent of BackupSnapshot.URI for PVC), this
109109
// driver intentionally narrows the API contract to S3 only. The S3
110-
// path is fully exercised end-to-end on dev7 and covered by unit +
111-
// e2e tests.
110+
// path is fully exercised end-to-end on a test cluster and covered by
111+
// unit + e2e tests.
112112
// +kubebuilder:validation:XValidation:rule="has(self.s3)",message="s3 destination is required (PVC is intentionally not supported by this strategy until upstream restore-agent reads the same path the backup-agent writes; see the strategy comments)"
113113
type EtcdDestinationTemplate struct {
114114
// S3 configures an S3-compatible storage target. Templating is

‎cmd/cozystack-operator/main_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ func TestInstallPlatformPackageSource_Updates(t *testing.T) {
122122
// TestInstallPlatformPackageSource_RefusesTapOwned asserts that when a
123123
// marketplace tap has materialized a PackageSource under a name the platform
124124
// later ships, the platform refuses to overwrite it, names the conflict, and
125-
// leaves the object untouched (kvaps' review point).
125+
// leaves the object untouched.
126126
func TestInstallPlatformPackageSource_RefusesTapOwned(t *testing.T) {
127127
s := newTestScheme()
128128
tapOwned := &cozyv1alpha1.PackageSource{

‎docs/oidc-grafana.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ CR:
9696
`user.Groups` slice empty regardless of what the userinfo endpoint
9797
returns, and the gate rejects every login with "user not a member
9898
of one of the required groups" — even when the token carries the
99-
correct claim (verified end-to-end on dev3 with Grafana v11.6.15).
99+
correct claim (verified end-to-end on a test cluster with Grafana v11.6.15).
100100
The JMESPath expression `groups` reads the top-level `groups`
101101
array from userinfo, matching the shape Keycloak's
102102
`oidc-group-membership-mapper` emits.

‎docs/operations/backup-classes.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,7 @@ A `recoveryTime` **before the earliest base backup** fails differently: PostgreS
415415

416416
### Discovering the earliest / latest restorable time
417417

418-
CNPG's `Cluster.status.firstRecoverabilityPoint` exists in the status schema but is unreliable under the barman-cloud plugin — it was observed empty on every plugin-backed cluster on the dev7 test cluster (CNPG 1.28.1) — so read the window from the backup catalog instead. Each completed base backup records its WAL range and timestamps on the underlying `cnpg.io/Backup`:
418+
CNPG's `Cluster.status.firstRecoverabilityPoint` exists in the status schema but is unreliable under the barman-cloud plugin — it was observed empty on every plugin-backed cluster in a test environment (CNPG 1.28.1) — so read the window from the backup catalog instead. Each completed base backup records its WAL range and timestamps on the underlying `cnpg.io/Backup`:
419419

420420
```bash
421421
# Completed base backups, oldest first: STOP plus one second is the earliest

‎hack/e2e-prepare-cluster.bats‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -153,27 +153,6 @@ machine:
153153
docker.io:
154154
endpoints:
155155
- https://mirror.gcr.io
156-
#docker.io:
157-
# endpoints:
158-
# - https://dockerio.nexus.aenix.org
159-
#cr.fluentbit.io:
160-
# endpoints:
161-
# - https://fluentbit.nexus.aenix.org
162-
#docker-registry3.mariadb.com:
163-
# endpoints:
164-
# - https://mariadb.nexus.aenix.org
165-
#gcr.io:
166-
# endpoints:
167-
# - https://gcr.nexus.aenix.org
168-
#ghcr.io:
169-
# endpoints:
170-
# - https://ghcr.nexus.aenix.org
171-
#quay.io:
172-
# endpoints:
173-
# - https://quay.nexus.aenix.org
174-
#registry.k8s.io:
175-
# endpoints:
176-
# - https://k8s.nexus.aenix.org
177156
files:
178157
- content: |
179158
[plugins]

‎internal/backupcontroller/cnpgstrategy_controller.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -137,8 +137,8 @@ const (
137137
cnpgWALArchiveDeadline = 3 * time.Minute
138138

139139
// Both constants below couple to CNPG/PostgreSQL internals. Verified
140-
// against CNPG 1.28.1 + barman-cloud plugin (postgresql:18.1) on the dev7
141-
// test cluster. The negative e2e in examples/backups/postgres/run-all.sh
140+
// against CNPG 1.28.1 + barman-cloud plugin (postgresql:18.1) on a test
141+
// cluster. The negative e2e in examples/backups/postgres/run-all.sh
142142
// (step 46: a recoveryTime past the archive must fail with reason
143143
// RecoveryTargetUnreachable) is what catches a drift in either string on
144144
// a future CNPG/PostgreSQL bump - if it regresses, this fail-fast silently

‎internal/backupcontroller/etcdstrategy_controller_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,7 @@ func TestS3KeyFromArtifactURI(t *testing.T) {
559559
}
560560

561561
// TestResolveEtcdRestoreDestination_PrefersArtifactURIForRevSuffix is
562-
// the integration test for the bug found on dev7: with a v0.4.4
562+
// the integration test for the bug found on a test cluster: with a v0.4.4
563563
// operator (BACKUP_INCLUDE_REVISION=true), the agent wrote
564564
// "etcd/etcd-backup-job-6gghq-rev2.db" but the driver's
565565
// buildEtcdRestoreS3Key would emit "etcd/etcd-backup-job-6gghq.db" —

‎internal/operator/packagesource_reconciler_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -714,7 +714,7 @@ func TestReconcile_DeletionTimestamp_EarlyReturn(t *testing.T) {
714714
}
715715

716716
// TestUpdateStatus_UnknownWithinGrace_SchedulesFollowUp locks in the fix for
717-
// the dormancy bug caught on dev3: when Ready=Unknown but grace hasn't elapsed
717+
// the dormancy bug caught on a test cluster: when Ready=Unknown but grace hasn't elapsed
718718
// yet, artifactGeneratorStuck returns false, we fall through to the copy path
719719
// and — without an explicit RequeueAfter — the reconciler would sleep until
720720
// the AG's next status change (which may never come if it's exactly the

‎packages/apps/kubernetes/templates/oidc-authn-config.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,12 @@ User identity claim: `email`, not `preferred_username`.
3737

3838
The design doc example used `claim: preferred_username`, but in the
3939
cozystack `cozy` realm `preferred_username` is the Keycloak *username*
40-
(`kvaps`, `i.okhotnikov`), NOT the email — and the operator-facing
40+
(`alice`, `j.doe`), NOT the email — and the operator-facing
4141
`users[].email` field asks for the email address. Matching the `User:`
4242
subject in the ClusterRoleBinding to `preferred_username` would
4343
silently misidentify every user whose Keycloak username differs from
44-
their email — verified on dev3 where token auth succeeded but the CRB
45-
match failed with 403.
44+
their email — verified on a test cluster where token auth succeeded
45+
but the CRB match failed with 403.
4646

4747
Switching the claim to `email` aligns the apiserver-visible identity
4848
with the operator's declared `users[].email` value. Requires the

‎packages/apps/kubernetes/tests/oidc_test.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ tests:
286286
- matchRegex:
287287
path: stringData["config.yaml"]
288288
pattern: "url: https://keycloak.example.org/realms/cozy"
289-
# Verified end-to-end on dev3: cozy realm's preferred_username is the
289+
# Verified end-to-end: cozy realm's preferred_username is the
290290
# Keycloak *username* (not the email), so a CRB subject sourced from
291291
# users[].email would silently mis-authenticate. Lock the claim name.
292292
- matchRegex:
@@ -314,7 +314,7 @@ tests:
314314
# The groups range MUST be wrapped in dyn(): claims.groups is statically
315315
# `any`, and the apiserver rejects a comprehension over `any` at startup
316316
# (CrashLoop). Pinning dyn() here makes a regression fail the unit suite
317-
# instead of only surfacing on a live apiserver. Verified on dev3 v1.32.
317+
# instead of only surfacing on a live apiserver. Verified on Kubernetes v1.32.
318318
- matchRegex:
319319
path: stringData["config.yaml"]
320320
pattern: 'expression: .+has\(claims\.groups\).+dyn\(claims\.groups\)\.exists\(g, g in .+tenant-foo-view.+tenant-foo-use.+tenant-foo-admin.+tenant-foo-super-admin'

0 commit comments

Comments
 (0)