Repository navigation

feat(api): explicit access grants between providers, branches and their users - #441

Merged

sunib merged 34 commits into

mainfrom

feat/provider-access-rules

Oct 24, 2026

Merged

feat(api): explicit access grants between providers, branches and their users#441
sunib merged 34 commits into
mainfrom
feat/provider-access-rules

Commits on Oct 23, 2026
- docs: plan who may reference what, before accessFrom ships
  
  sunib
  and
  claude
  committed
  c63b409
- docs: make every grant explicit, and map access between all objects
  
  sunib
  and
  claude
  committed
  ab31df7
- docs: settle the chart default, branch patterns and revocation promise
  
  sunib
  and
  claude
  committed
  eb5e7df
- docs: add a platform example, and state identity and hand-back precisely
  
  sunib
  and
  claude
  committed
  8688825
- docs: say where a grant admits from with an enum, and drop booleans
  
  sunib
  and
  claude
  committed
  51e7654
- docs: name the grant lists allowedGitBranches, allowedGitTargets, allowedApplierClaims
  
  sunib
  and
  claude
  committed
  91ed0a8
- docs: rewrap the naming paragraph to the line limit
  
  sunib
  and
  claude
  committed
  18e4db6
- docs: lead with one tenant end to end, and define cluster resources
  
  sunib
  and
  claude
  committed
  0f591da
- feat(api): add access grants with a required from, and branch patterns
  
  sunib
  and
  claude
  committed
  3e2f23f
- feat(authz): admit by explicit grants and remove accessFrom
  
  sunib
  and
  claude
  committed
  5a74f5f
- feat(git): claim only while admitted, and carry the provider's namespace
  
  sunib
  and
  claude
  committed
  1276c5c
- feat(controller): watch the Namespaces and providers that grants read
  
  sunib
  and
  claude
  committed
  9256470
- feat(watch): bound ClusterWatchRules by the grant's clusterResources
  
  sunib
  and
  claude
  committed
  cee08e4
- feat(applier): hand an applier back when its claim is denied
  
  sunib
  and
  claude
  committed
  a47aac9
- feat(chart): the local KubeProvider grants nothing by default
  
  sunib
  and
  claude
  committed
  65274aa
- test(e2e): grant the suite's access, and cover tenant branch grants
  
  sunib
  and
  claude
  committed
  6ff17ad
- docs: document access grants between providers, branches and their users
  
  sunib
  and
  claude
  committed
  89ae4d4
- test: cover clusterResources recovery by watch, and applier own namespace
  
  sunib
  and
  claude
  committed
  9aa5aaf
- test(e2e): pass the suite's grants to the Helm install as values
  
  sunib
  and
  claude
  committed
  5020949
- fix(git): a released branch claim hands the branch to nobody
  
  sunib
  and
  claude
  committed
  b5e5c7d
- fix(watch): check clusterResources against what the planner selects
  
  sunib
  and
  claude
  committed
  74183d5
- test(e2e): resolve the install mode outside a _test.go file
  
  sunib
  and
  claude
  committed
  cc83930
- docs: move the provider access plan to finished, with what shipped
  
  sunib
  and
  claude
  committed
  227c24a
- fix(applier): give a hand-back a denial began its own Held reason
  
  sunib
  and
  claude
  committed
  7d35abf
Commits on Oct 24, 2026
- refactor: fold duplicated grant and mapper code, and fix the clusterResources refusal text
  
  sunib
  and
  claude
  committed
  433138c
- test: name tests after grants, and share the grant fixtures
  
  sunib
  and
  claude
  committed
  5ccb58b
- docs: point two plans at the grants that replaced accessFrom
  
  sunib
  and
  claude
  committed
  dbfa1dd
- test(e2e): time out a hung k3d image import so the retry runs
  
  sunib
  and
  claude
  committed
  fd34097
- feat(api): name the grant consumer with {consumer.namespace} and {consumer.name}
  
  sunib
  and
  claude
  committed
  093bf85
- feat(api): allow {consumer.name} only beside {consumer.namespace} in a branch pattern
  
  sunib
  and
  claude
  committed
  6ba88dc
- refactor(api): rename the applier claim's Held condition to InControl
  
  sunib
  and
  claude
  committed
  fb16a98
- docs(api): say what each grant scope field permits, in the CRDs
  
  sunib
  and
  claude
  committed
  81d0aed
- refactor(api)!: nest each grant's "who" in a required consumerNamespaces block
  
  sunib
  and
  claude
  committed
  c84ca81
- docs: write every grant in the consumerNamespaces shape, and say what a scope permits
  
  sunib
  and
  claude
  committed
  7f41206

Commits

Commits on Oct 23, 2026

Commits on Oct 24, 2026