- Shipped
- September 23, 2026 at 6:04 AM UTC
- Author
- Kamo
- Commit
- f378930
The namespace, the single-replica StorageClass, the clusterwide seal, computeservice's RBAC and the tenant gateway. Guarded on the hosted-computers/ directory changing, like every other step. Two things it deliberately does NOT do. It does not reinstall KubeVirt or CDI. Those are cluster operators shared with the platform-admin desktop and the Remote Desktop step above already owns them. It does not apply the per-org namespaces, quotas or network policies. There is one set per tenant and they are rendered by computeservice when an organization's first computer is provisioned — nor the schema, which goes in by hand with the OWNER credential because ddl-auto is none everywhere and InitializerService is not deployed. The seal is applied FIRST and from CI rather than by the service. A Cilium deny beats every allow from any file, so it cannot be undone by a later edit to a tenant's own policy — and a service able to edit its tenants' seal is a service whose bugs can open them, which is why computeservice's RBAC leaves that resource out. Both secrets are optional and the absence is reported rather than fatal: without the signing key the launch path says the gateway is not configured yet, and without the encryption key provisioning fails closed. Both are better than a deploy that stops because a feature nobody has switched on has no secrets.