7a63135d26
DatabaseAdminController's active-queries and kill-query endpoints could
expose SQL text from other tenants sharing the same PostgreSQL instance.
Added ApplicationName=tenant_{id} to the JDBC URL and filter
pg_stat_activity by application_name so each tenant only sees its own
connections.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
41 lines
1.2 KiB
YAML
41 lines
1.2 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
namespace: BRANCH_NAMESPACE
|
|
resources:
|
|
- ../../base
|
|
- ingress.yaml
|
|
- init-job.yaml
|
|
images:
|
|
- name: gitea.siegeln.net/cameleer/cameleer3-server
|
|
newTag: BRANCH_SHA
|
|
- name: gitea.siegeln.net/cameleer/cameleer3-server-ui
|
|
newTag: BRANCH_SHA
|
|
patches:
|
|
# Server Deployment: branch-specific schema, index prefix, UI origin
|
|
- patch: |
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: cameleer3-server
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: server
|
|
env:
|
|
- name: SPRING_DATASOURCE_URL
|
|
value: "jdbc:postgresql://cameleer-postgres.cameleer.svc.cluster.local:5432/cameleer3?currentSchema=BRANCH_SCHEMA&ApplicationName=BRANCH_SCHEMA"
|
|
- name: CAMELEER_SERVER_SECURITY_UIORIGIN
|
|
value: "http://BRANCH_SLUG.cameleer.siegeln.net"
|
|
# UI ConfigMap: branch-specific API URL
|
|
- target:
|
|
kind: ConfigMap
|
|
name: cameleer3-ui-config
|
|
patch: |
|
|
- op: replace
|
|
path: /data/config.js
|
|
value: |
|
|
window.__CAMELEER_CONFIG__ = {
|
|
apiBaseUrl: '/api/v1',
|
|
};
|