miki3421 opened a new pull request, #152: URL: https://github.com/apache/openserverless-operator/pull/152
FerretDB clients that omit Mongo credentials currently inherit the PostgreSQL system identity configured in `FERRETDB_POSTGRESQL_URL`. Remove that default identity from the operator-generated backend URL and the base manifest, so clients must supply their existing credentials. Keep the backend database unset to preserve tenant database selection. Explicitly authenticated tenant and system Mongo URIs remain unchanged. Six regression tests cover both backend URL paths and authenticated client metadata; they are discovered by the existing Check workflow. Validation: - All 83 regression tests passed on this branch, including the six new tests; `git diff --check` passed. - Tested isolated control/candidate gateways using the exact same FerretDB 1.6.0 image digest and disposable PostgreSQL data. - Applied the change to the shared K3s lab. Real anonymous OpenWhisk actions were denied reads, inserts, updates, deletes, collection creation/rename/drop and logical database deletion, including after valid tenant connections. - Real Alpha/Beta actions retained CRUD, indexes and aggregation. Peer-data checks confirmed isolation; all 15 application checks passed. Existing application source, credentials, resource identities and persistent volumes were preserved. For existing installations, updating the operator image alone does not reconcile the running FerretDB StatefulSet: update its backend URL and roll the gateway pods to replace instances holding the previous default identity. Normal image builds regenerate `deploy.tar`; custom overlay images must also update its manifest because `run.sh` extracts that archive into the deployment volume at startup. This was verified in the lab. GitHub CI for this PR is separate from the local/lab validation above. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
