chore(RELEASE-2696): add release ns to stage CSS

[johnbieren]

This commit adds the konflux-release-service-tenant namespace to the stage ClusterSecretStore namespace allow list. Release-service E2E will be orchestrated from stage instead of prod so ExternalSecrets need to work there.

[qodo-for-redhat-appstudio]

PR Summary by Qodo

Allow release-service secrets in the staging namespace

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Allow the release-service tenant namespace to use the staging ClusterSecretStore.
• Enable ExternalSecrets for release-service E2E workflows orchestrated from staging.

Diagram

graph TD
  K["Staging Kustomization"] -->|applies| P["Namespace Patch"] -->|extends allow list| S["ClusterSecretStore"] -->|permits secrets| N["Release Tenant"]

Loading

High-Level Assessment

The PR follows the existing staging Kustomize patch pattern and scopes access to the required namespace. A broader wildcard or base-level permission would weaken environment isolation without providing a meaningful benefit.

Files changed (2) +10 / -0

Other (2) +10 / -0

konflux-release-service-namespaces-patch.yamlAllow the release-service tenant namespace +4/-0

Allow the release-service tenant namespace

• Adds the konflux-release-service-tenant namespace to the ClusterSecretStore condition allow list, enabling ExternalSecrets for staging-orchestrated release-service E2E workflows.

components/cluster-secret-store/staging/konflux-release-service-namespaces-patch.yaml

kustomization.yamlRegister the release-service namespace patch +6/-0

Register the release-service namespace patch

• Targets the new patch at the appsre-stonesoup-vault ClusterSecretStore in the staging overlay.

components/cluster-secret-store/staging/kustomization.yaml

[github-actions]

Kustomize Render Diff

Comparing 764954829 → d0487f4de

Component	Environment	Changes
components/cluster-secret-store/staging	staging	+1 -0

Total: 1 components, +1 -0 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

[qodo-for-redhat-appstudio]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.38%. Comparing base (7649548) to head (71d9e71).
⚠️ Report is 15 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13696   +/-   ##
=======================================
  Coverage   60.38%   60.38%           
=======================================
  Files          24       24           
  Lines        1628     1628           
=======================================
  Hits          983      983           
  Misses        563      563           
  Partials       82       82           

Flag	Coverage Δ
go	60.38% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johnbieren, mshaposhnik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• components/cluster-secret-store/OWNERS [mshaposhnik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment