Skip to content

[tenant] remove isolated flag and enforce isolation - #1896

Merged
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
feat/deprecate-tenant-isolated-field
Jan 22, 2026
Merged

[tenant] remove isolated flag and enforce isolation#1896
Andrei Kvapil (kvaps) merged 1 commit into
mainfrom
feat/deprecate-tenant-isolated-field

Conversation

@sircthulhu

@sircthulhu Kirill Ilin (sircthulhu) commented Jan 21, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

What this PR does

Removes Tenant isolated flag and enforces isolation using network policies

Release note

[tenant] Removed Tenant field `isolated` and enforced network isolation

Summary by CodeRabbit

  • Chores
    • Network policies for tenant namespace isolation are now always enforced and cannot be disabled.
    • Removed the isolated configuration parameter from all tenant settings, schema definitions, and documentation.

✏️ Tip: You can customize this high-level summary in your review settings.

@dosubot dosubot Bot added the size/S This PR changes 10-29 lines, ignoring generated files label Jan 21, 2026
@gemini-code-assist

gemini-code-assist Bot commented Jan 21, 2026

Copy link
Copy Markdown
Contributor

Summary of Changes

Hello Kirill Ilin (@sircthulhu), I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request simplifies tenant network isolation by eliminating the configurable isolated flag. Instead of allowing tenants to specify their isolation preference, network policies are now universally enforced, ensuring all tenants operate within a secure, isolated environment by default. This change streamlines configuration and enhances the overall security of tenant deployments.

Highlights

  • Removal of isolated flag: The isolated configuration flag, which previously allowed tenants to opt-in or out of network isolation, has been completely removed from all tenant definitions and configurations.
  • Enforced Network Isolation: Network policies for tenant isolation are now unconditionally applied. This ensures that all tenants are isolated by default, removing the need for a configurable flag and strengthening the security posture.
  • Configuration and Schema Updates: All related documentation, Helm values schemas, default values, and the Custom Resource Definition (CRD) for Tenant have been updated to reflect the removal of the isolated flag.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature Command Description
Code Review /gemini review Performs a code review for the current pull request in its current state.
Pull Request Summary /gemini summary Provides a summary of the current pull request in its current state.
Comment Gemini (@gemini-code-assist) Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help /gemini help Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

  1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

@coderabbitai

coderabbitai Bot commented Jan 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

The pull request removes the isolated parameter from the tenant application across configuration files, schema definitions, and documentation. Network policies transition from conditionally rendered to unconditionally applied, with all configuration references and schema definitions updated accordingly.

Changes

Cohort / File(s) Summary
Tenant application configuration
packages/apps/tenant/README.md, packages/apps/tenant/values.yaml, packages/apps/tenant/values.schema.json		 Removed isolated parameter documentation, default value entry, and schema property definition respectively. Parameter no longer exposed for user configuration.
Tenant application template
packages/apps/tenant/templates/networkpolicy.yaml		 Removed conditional Helm wrapper ({{- if .Values.isolated }} and {{- end }}), converting network policy definitions from optional to always-rendered.
System tenant resource definition
packages/system/tenant-rd/cozyrds/tenant.yaml		 Removed isolated field from ApplicationDefinition's OpenAPI schema and updated keysOrder to reflect removal.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 No more isolation walls,
The policies stand strong for all,
One less param to maintain,
Simplicity's the gain,
Networks flow, unconfined and tall ✨

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately reflects the main change: removing the isolated flag and enforcing isolation through network policies.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

gemini-code-assist[bot]
gemini-code-assist Bot reviewed Jan 21, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request aims to enforce tenant isolation by removing the optional isolated flag and applying network policies unconditionally. The changes across the documentation, Helm chart values, schema, and CRD are consistent with this goal. However, I've found a critical security concern in one of the network policies that is now being enforced. The allow-external-communication policy opens up all pods in the tenant to the world, which is contrary to the principle of isolation. Please see my detailed comment on this.

Comment thread packages/apps/tenant/templates/networkpolicy.yaml
@kvaps

Andrei Kvapil (kvaps) commented Jan 21, 2026

Copy link
Copy Markdown
Member

/retest

1 similar comment
@kvaps

Andrei Kvapil (kvaps) commented Jan 21, 2026

Copy link
Copy Markdown
Member

/retest

@dosubot dosubot Bot added the lgtm This PR has been approved by a maintainer label Jan 22, 2026
@kvaps
Andrei Kvapil (kvaps) merged commit 2812df8 into main Jan 22, 2026
62 of 65 checks passed
@kvaps
Andrei Kvapil (kvaps) deleted the feat/deprecate-tenant-isolated-field branch January 22, 2026 16:56
Kirill Ilin (sircthulhu) added a commit to cozystack/website that referenced this pull request Jan 23, 2026
@sircthulhu
Remove isolated field from Tenant
680b2a1 
See cozystack/cozystack#1896

Signed-off-by: Kirill Ilin <[email protected]>
@sircthulhu Kirill Ilin (sircthulhu) mentioned this pull request Jan 23, 2026
Merged
Kirill Ilin (sircthulhu) added a commit to cozystack/website that referenced this pull request Jan 23, 2026
@sircthulhu
Remove isolated field from Tenant
a99fa00 
See cozystack/cozystack#1896

Signed-off-by: Kirill Ilin <[email protected]>
Kirill Ilin (sircthulhu) added a commit to cozystack/website that referenced this pull request Jan 23, 2026
@sircthulhu
Remove isolated field from Tenant
3ad5668 
See cozystack/cozystack#1896

Signed-off-by: Kirill Ilin <[email protected]>
Nikita (nbykov0) added a commit to cozystack/website that referenced this pull request Jan 23, 2026
@nbykov0
Remove isolated field from Tenant (#404)
b1f2586 
See cozystack/cozystack#1896
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kvaps Andrei Kvapil (kvaps) kvaps approved these changes
@lllamnyp Timofei Larkin (lllamnyp) Awaiting requested review from lllamnyp lllamnyp is a code owner
@nbykov0 Nikita (nbykov0) Awaiting requested review from nbykov0
+1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

@sircthulhu Kirill Ilin (sircthulhu)

Labels

lgtm This PR has been approved by a maintainer size/S This PR changes 10-29 lines, ignoring generated files

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sircthulhu @kvaps