env create/delete/gc/list manage a namespace per environment, labelled
zero-scale.io/env, with a ResourceQuota, its own gateway and an optional
wildcard route. A zero-scale-env ConfigMap records the env and may override
the platform's database clusters. Hosts use ${ENV_SUFFIX}; databases in a
non-primary env are named db_<env>_<app>_<hash> and carry an owner comment,
so env delete drops only what the env owns. oauth-setup --auth-host serves
every app's login from one callback host. deploy/ manifests no longer
hardcode a namespace; deploy/kustomization.yaml sets it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016uKdmp7tLySXvQXALz2x9V
- Introduced GatewayConfig struct to hold OAuth2 configuration in AppConfig.
- Implemented OAuthSetupName method to resolve shared OAuth2 profile name.
- Enhanced LoadConfig function to parse gateway configuration from the config file.
- Added oauth-setup command to create or update shared ingress-nginx OAuth2 setup profiles.
- Implemented ReconcileOAuthSetup function to provision/update OAuth2 credentials and resources.
- Created OAuth2 proxy deployment and service for shared OAuth2 setup.
- Added Ingress configuration for OAuth2 callback routing.
- Updated DeployBinary function to check and upload binaries based on SHA256 hash.
- Enhanced secret management in ProvisionDataLayer to support cross-service references.
- Updated ingress creation to support OAuth2 authentication.
- Added RAM and CPU resource display in the zero-scale dashboard for active applications.
- Implemented dynamic updates for resource display based on application state.
feat: expand zero-scale control script with new commands and options
- Introduced `apply`, `upload-binary`, and `provision-db` commands to the zero-scale control script.
- Added options for specifying configuration files, binary uploads, and database provisioning parameters.
feat: implement temporal JWKS aggregator service
- Created a new service to aggregate JWKS from Gitea and Kubernetes API.
- Implemented caching and refresh logic for JWKS keys.
feat: deploy shared MySQL and Redis services
- Added Kubernetes manifests for shared MySQL and Redis services, including StatefulSet and ConfigMap definitions.
- Configured persistent storage and resource limits for MySQL and Redis deployments.
feat: add temporal OAuth secret example and values configuration
- Created example secret manifest for OAuth credentials required by Temporal.
- Added a values file for configuring Temporal server with JWKS integration and resource limits.
feat: implement Kubernetes token provider for Temporal client
- Developed a K8sTokenHeadersProvider to supply Kubernetes service account tokens to Temporal.
- Added tests for token retrieval and environment variable fallback.
