packages/system/postgres-rd/cozyrds/postgres.yaml:46 includes matchLabels: internal.cozystack.io/tenant-ca: "true" under spec.secrets.include, so a Secret carrying that label joins the tenant's readable set as soon as the lineage webhook can resolve its owner. Nothing in packages/apps/postgres/ pins what that surface may contain: there is no dashboard-resourcemap_test.yaml, and the dashboard Role granting <release>-credentials is asserted nowhere.
Two changes break it without turning a test red. A rule granting secrets with no resourceNames is unrestricted rather than narrow, so it adds no name for a name-by-name check to notice. And a second matchLabels entry on a label the operator stamps on its own Secrets reaches key-bearing ones while every name in the file stays correct.
qdrant pins both layers in cozystack/cozystack#3341, and both pins were confirmed by mutation rather than by reading: the ResourceDefinition against the rendered chart, because the template globs cozyrds/ and reading one file there misses a second, and the Role with its binding compared whole across value permutations instead of probed for known-bad names. The two files port to postgres almost verbatim; only the chart path and the expected Secret set differ. nats has the same gap.
This predates the qdrant work: the selector is on main, and the missing tests are missing there too.
packages/system/postgres-rd/cozyrds/postgres.yaml:46includesmatchLabels: internal.cozystack.io/tenant-ca: "true"underspec.secrets.include, so a Secret carrying that label joins the tenant's readable set as soon as the lineage webhook can resolve its owner. Nothing inpackages/apps/postgres/pins what that surface may contain: there is nodashboard-resourcemap_test.yaml, and the dashboard Role granting<release>-credentialsis asserted nowhere.Two changes break it without turning a test red. A rule granting
secretswith noresourceNamesis unrestricted rather than narrow, so it adds no name for a name-by-name check to notice. And a secondmatchLabelsentry on a label the operator stamps on its own Secrets reaches key-bearing ones while every name in the file stays correct.qdrant pins both layers in cozystack/cozystack#3341, and both pins were confirmed by mutation rather than by reading: the ResourceDefinition against the rendered chart, because the template globs
cozyrds/and reading one file there misses a second, and the Role with its binding compared whole across value permutations instead of probed for known-bad names. The two files port to postgres almost verbatim; only the chart path and the expected Secret set differ. nats has the same gap.This predates the qdrant work: the selector is on
main, and the missing tests are missing there too.