unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

arrproxy: bump images to v0.5.0 (per-token method scoping) #443

Merged
benvin merged 1 commits from benvin/arrproxy-0.5.0 into main 2026-08-30 14:23:44 +10:00
Conversation 0 Commits 1 Files Changed 4
+22 -5
unkin-agent commented 2026-08-30 14:20:57 +10:00
Member
Copy Link
Copy Source

Why

arrproxy v0.5.0 ships per-token HTTP method scoping for machine tokens, so a minted token can be limited to e.g. GET only. Zero-downtime: the mint-API field is additive and existing tokens get an empty methods list, which means unrestricted — they behave exactly as before.

How

  • Bump arrproxy-api and arrproxy-ui pins from v0.4.0 to v0.5.0.
  • Mirror repo migrations 0002_tier_tokens.sql and 0003_token_methods.sql into the migrations ConfigMap. It had drifted at 0001 while v0.4.0 already queried tier/read_only, and every v0.5.0 token query selects methods — without this the new API errors on every token read.
  • Have the wave-1 migrate Job apply all three files in order. Every statement is IF NOT EXISTS, so a resync over an already-migrated database is a no-op.

Rendered kustomize build --enable-helm apps/overlays/au-syd1/arrstack diff vs main is exactly the two image tags, the two added ConfigMap keys, and the two added -f args.

## Why arrproxy v0.5.0 ships per-token HTTP method scoping for machine tokens, so a minted token can be limited to e.g. `GET` only. Zero-downtime: the mint-API field is additive and existing tokens get an empty methods list, which means unrestricted — they behave exactly as before. ## How - Bump `arrproxy-api` and `arrproxy-ui` pins from v0.4.0 to v0.5.0. - Mirror repo migrations `0002_tier_tokens.sql` and `0003_token_methods.sql` into the migrations ConfigMap. It had drifted at 0001 while v0.4.0 already queried `tier`/`read_only`, and every v0.5.0 token query selects `methods` — without this the new API errors on every token read. - Have the wave-1 migrate Job apply all three files in order. Every statement is `IF NOT EXISTS`, so a resync over an already-migrated database is a no-op. Rendered `kustomize build --enable-helm apps/overlays/au-syd1/arrstack` diff vs main is exactly the two image tags, the two added ConfigMap keys, and the two added `-f` args.
unkin-agent added 1 commit 2026-08-30 14:20:57 +10:00
arrproxy: bump images to v0.5.0 (per-token method scoping)
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
ba947c92ad 
arrproxy v0.5.0 adds per-token HTTP method scoping for machine tokens, so a
minted token can be limited to e.g. GET only. Existing tokens keep an empty
methods list and stay unrestricted.

- Bump arrproxy-api and arrproxy-ui pins to v0.5.0
- Mirror migrations 0002_tier_tokens.sql and 0003_token_methods.sql into the
  migrations ConfigMap, which had drifted at 0001 while v0.4.0 already queried
  tier/read_only and v0.5.0 queries methods
- Have the wave-1 migrate Job apply all three files in order (every statement
  is idempotent, so a resync over a migrated database is a no-op)
benvin merged commit 221c575a44 into main 2026-08-30 14:23:44 +10:00
benvin deleted branch benvin/arrproxy-0.5.0 2026-08-30 14:23:44 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#443
Delete Branch "benvin/arrproxy-0.5.0"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?