feat: multi SCP composition #8917

pkoutsovasilis · 2025-11-20T12:18:31Z

Overview

This PR implements support for multiple StackConfigPolicies (SCPs) targeting the same Elasticsearch cluster or Kibana instance, using a weight-based priority system for deterministic policy composition.

Key Features

Weight-Based Priority System

Policies are merged in order of weight (lower weight takes precedence)
Default weight: 0

Conflict Detection

Conflicts are detected across multiple dimensions and will prevent policy application:

Conflict Type	Condition	Result
Weight Conflict	Two or more policies with identical weights target the same Elasticsearch/Kibana	❌ Conflict
SecretMount Name Conflict	Different policies define `SecretMount` with same `SecretName`	❌ Conflict
SecretMount Path Conflict	Different policies define `SecretMount` with same `MountPath`	❌ Conflict
Different Weights	Policies have different weights and none of the above applies	✅ Pass - lower weight wins

Important: Even if two policies with the same weight have non-overlapping resources, they still conflict because the weight collision makes the merge order ambiguous.

Configuration Merging Behaviour

Different merge strategies are applied based on the configuration type:

Deep Merge (recursive merging):
- ClusterSettings
- Config
- SnapshotLifecyclePolicies
- SecurityRoleMappings
- IndexLifecyclePolicies
- IngestPipelines
- IndexTemplates.ComposableIndexTemplates
- IndexTemplates.ComponentTemplates
Top-Level Key Replacement (entire keys replaced):
- SnapshotRepositories - each repository configuration is treated atomically
Union Merge (with conflict detection):
- SecretMounts - conflicts on duplicate SecretName OR duplicate MountPath
- SecureSettings - merges by SecretName+Key, lower weight wins (no conflicts)

Multi-Soft-Owner Secret Management

File Settings and Policy Config Secrets:

Now support multiple soft owners
Secrets are only deleted when all referencing soft-owners are removed
Uses eck.k8s.elastic.co/owner-refs annotation with JSON-encoded map of owner namespaced names

Secret Sources:

Remain single soft owner (existing behaviour unchanged)

This prevents secret leakage while enabling proper cleanup when policies are deleted.

Related Issues

Supersedes feat: Multi StackConfigPolicy per cluster #8793

prodsecmachine · 2025-11-20T12:18:43Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2025-11-20T12:19:23Z

🔍 Preview links for changed docs

docs/reference/api-reference/main.md

kvalliyurnatt · 2025-11-21T21:00:12Z

Just a general question/comment that came to my mind, do we want to have any limits on the number of SCPs that can be associated to a cluster ?
I was just trying to think what potential issues we might face when we have a large number of SCPs(if that is even a practical scenario) associated with a single ES cluster and if there is a practical maximum that we can enforce. One thing that came to my mind while thinking about scale was the annotation for soft owners, maybe we run into some kind of limit with the annotation map size? (I think the annotation limit is 256KB which I think should not be something to worry about ?)
Wondering if there are any other such things to consider.

barkbay · 2025-11-24T11:01:36Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+				esPolicy.PoliciesWithConflictErrors[policyNsn] = err
+
+				if previouslyAppliedPolicy != nil {
+					previouslyAppliedPolicyNsn := k8s.ExtractNamespacedName(previouslyAppliedPolicy)


I'm not sure I understand why we use previouslyAppliedPolicy here? The conflict could come from another policy applied before?

For example, assuming we have 3 policies (p1,p2,p3), processed in that order. Let's also assume p1 conflicts with p3 then IIUC we are going to report a conflict between p1 and p2? While the conflict is actually between p1 and p3?

Looks like I should have reloaded the PR before posting my comments: #8917 (comment)

yep you are both right, this conflict does not originate only from the previously applied policy

I changed this in b5eaad2 and I believe now that the conflicting policies are captured correctly

barkbay · 2025-11-24T11:03:47Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+	// PoliciesWithConflictErrors maps policy namespaced names to conflict errors when multiple policies
+	// have the same weight
+	PoliciesWithConflictErrors map[types.NamespacedName]error


Is it only because they have the same weight? My understanding is that mergeElasticsearchConfig can also lead to policies being recorded here?

the secretName collision came afterwards and I didn't update the godoc to include this reason as well

I have simplified the conflict handling logic in b5eaad2

barkbay · 2025-11-24T11:12:01Z

pkg/controller/stackconfigpolicy/controller.go

+			if esPolicyConfigFinal == nil {
+				continue
+			}
+			conflictErr, exists := esPolicyConfigFinal.PoliciesWithConflictErrors[reconcilingPolicyNsn]


Let's maybe add a comment to explain why using only err is not enough, and why we need to get conflictErr from esPolicyConfigFinal.PoliciesWithConflictErrors

I changed the behaviour in b5eaad2 and now I am using only err

pebrc

I did a first pass, just looking at the code. I have not tested it yet. Will try to find some more time later today.

pebrc · 2025-11-24T09:38:26Z

pkg/controller/common/annotation/constants.go

 	ElasticsearchConfigAndSecretMountsHashAnnotation = "policy.k8s.elastic.co/elasticsearch-config-mounts-hash" //nolint:gosec
 	SourceSecretAnnotationName                       = "policy.k8s.elastic.co/source-secret-name"               //nolint:gosec
+
+	SoftOwnerRefsAnnotation = "eck.k8s.elastic.co/owner-refs"


Should we keep it close to the existing labels used for soft owner refs?

moved this closer to the existing labels here dd18a2d

pebrc · 2025-11-24T10:09:51Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+	// Process policies in order of weight (lowest first)
+	slices.Sort(weights)
+
+	// Reverse the weights so that we process policies in order of weight (highest first)
+	slices.Reverse(weights)


// Process policies in order of weight (highest first) slices.SortFunc(weights, func(a, b int32) int { return cmp.Compare(b, a) // Reversed comparison for descending order })

Yours is kind of easier to read ...

changed in b5eaad2

pebrc · 2025-11-24T10:12:18Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+	// have the same weight
+	PoliciesWithConflictErrors map[types.NamespacedName]error
+	// PoliciesRefs contains all StackConfigPolicies that target this Kibana instance
+	PoliciesRefs []policyv1alpha1.StackConfigPolicy


Suggested change

PoliciesRefs []policyv1alpha1.StackConfigPolicy

PolicyRefs []policyv1alpha1.StackConfigPolicy

nit: double plural

changed in b5eaad2

pebrc · 2025-11-24T10:12:41Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+	// have the same weight
+	PoliciesWithConflictErrors map[types.NamespacedName]error
+	// PoliciesRefs contains all StackConfigPolicies that target this Elasticsearch cluster
+	PoliciesRefs []policyv1alpha1.StackConfigPolicy


Suggested change

PoliciesRefs []policyv1alpha1.StackConfigPolicy

PolicyRefs []policyv1alpha1.StackConfigPolicy

nit: double plural

changed in b5eaad2

pebrc · 2025-11-24T10:15:26Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+// doesPolicyRefsObject checks if the given StackConfigPolicy targets the given Elasticsearch cluster.
+// A policy targets an Elasticsearch cluster if both following conditions are met:
+// 1. The policy is in either the operator namespace or the same namespace as the Elasticsearch cluster
+// 2. The policy's label selector matches the Elasticsearch cluster's labels
+// Returns true or false depending on whether the given policy targets the Elasticsearch cluster and
+// an error if the label selector is invalid.
+func doesPolicyRefsObject(policy *policyv1alpha1.StackConfigPolicy, obj metav1.Object, operatorNamespace string) (bool, error) {


Suggested change

// doesPolicyRefsObject checks if the given StackConfigPolicy targets the given Elasticsearch cluster.

// A policy targets an Elasticsearch cluster if both following conditions are met:

// 1. The policy is in either the operator namespace or the same namespace as the Elasticsearch cluster

// 2. The policy's label selector matches the Elasticsearch cluster's labels

// Returns true or false depending on whether the given policy targets the Elasticsearch cluster and

// an error if the label selector is invalid.

func doesPolicyRefsObject(policy *policyv1alpha1.StackConfigPolicy, obj metav1.Object, operatorNamespace string) (bool, error) {

// doesPolicyTargetObject checks if the given StackConfigPolicy targets the given object

// A policy targets an object if both following conditions are met:

// 1. The policy is in either the operator namespace or the same namespace as the object

// 2. The policy's label selector matches the objects's labels

// Returns true or false depending on whether the given policy targets the object and

// an error if the label selector is invalid.

func doesPolicyTargetObject(policy *policyv1alpha1.StackConfigPolicy, obj metav1.Object, operatorNamespace string) (bool, error) {

Or alternatively: doesPolicyMatchObject

gonna go with doesPolicyMatchObject

changed in b5eaad2

pebrc · 2025-11-24T10:38:09Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+	// Add all destination entries
+	for _, secureSetting := range dst {
+		secureSettings[secureSetting.SecretName] = make(map[string]commonv1.KeyToPath)
+		for _, entry := range secureSetting.Entries {


Entries is optional. If not specified all entries of the secret should be used.

changed in b5eaad2, no more special handling Secret sources, these are just getting merged as they come

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

pebrc · 2025-11-24T10:49:00Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+
+	// Group policies by weight
+	var weights []int32
+	weightKeyStackPolicies := make(map[int32][]*policyv1alpha1.StackConfigPolicy)


Suggested change

weightKeyStackPolicies := make(map[int32][]*policyv1alpha1.StackConfigPolicy)

policiesByWeight := make(map[int32][]*policyv1alpha1.StackConfigPolicy)

changed in b5eaad2

pebrc · 2025-11-24T11:08:47Z

pkg/controller/stackconfigpolicy/controller.go

 		// create the expected Settings Secret
-		expectedSecret, expectedVersion, err := filesettings.NewSettingsSecretWithVersion(esNsn, &actualSettingsSecret, &policy, meta)
+		expectedSecret, expectedVersion, err := filesettings.NewSettingsSecretWithVersion(esNsn, &actualSettingsSecret, &policyv1alpha1.StackConfigPolicy{
+			ObjectMeta: reconcilingPolicy.ObjectMeta,


Does this not introduce a bug in that the secure settings sources will always be looked for in the namespace of reconciling policy? It needs to be specific to the source policy doesn't it? Also as we can have mulitple polices being reconciled will we not have an edit war over the namespace of the secret source?

yes you are right this is a bug, I did miss the fact that we use also the policy namespace for the secure settings. thx for catching that

I changed this in b5eaad2 to extract namespaced secret sources during the merging of all policies

pebrc · 2025-11-24T11:12:02Z

pkg/controller/stackconfigpolicy/stackconfigpolicy.go

+// It processes all provided policies, filtering those that target the Elasticsearch cluster, and merges them
+// in order of their weight (lowest to highest). Policies with the same weight are flagged as conflicts.
+// Returns an esPolicyConfig containing the merged configuration and any error occurred during merging.
+func getPolicyConfigForElasticsearch(es *esv1.Elasticsearch, allPolicies []policyv1alpha1.StackConfigPolicy, params operator.Parameters) (*esPolicyConfig, error) {


There is a lot of overlap with the Kibana version of this function. We could go with a generic version:

// Generic config holder type policyConfig[T any] struct { Spec T PoliciesWithConflictErrors map[types.NamespacedName]error PoliciesRefs []policyv1alpha1.StackConfigPolicy } // Generic merge function func getPolicyConfigFor[T any]( obj metav1.Object, // Both ES and KB implement this allPolicies []policyv1alpha1.StackConfigPolicy, params operator.Parameters, extractSpec func(*policyv1alpha1.StackConfigPolicy) T, mergeSpec func(*T, T) error, ) (*policyConfig[T], error) { // ... unified implementation ... } // Usage: esConfig, err := getPolicyConfigFor( es, allPolicies, params, func(p *policyv1alpha1.StackConfigPolicy) policyv1alpha1.ElasticsearchConfigPolicySpec { return p.Spec.Elasticsearch }, mergeElasticsearchConfig, ) kbConfig, err := getPolicyConfigFor( kb, allPolicies, params, func(p *policyv1alpha1.StackConfigPolicy) policyv1alpha1.KibanaConfigPolicySpec { return p.Spec.Kibana }, mergeKibanaConfig, )

Or we could maybe at least pull the shared bits into functions used from both?

Idk something like

func groupPoliciesByWeight(allPolicies []policyv1alpha1.StackConfigPolicy, filter func(*policyv1alpha1.StackConfigPolicy) bool) ([]int32, map[int32][]*policyv1alpha1.StackConfigPolicy, []policyv1alpha1.StackConfigPolicy) func handleWeightConflicts[T any](config *policyConfig[T], policiesWithSameWeight []*policyv1alpha1.StackConfigPolicy, weight int32) error

I did a refactor that follows the proposed generics approach in b5eaad2

barkbay · 2025-11-24T12:26:02Z

pkg/controller/stackconfigpolicy/controller.go

+		switch {
+		case errors.Is(err, errMergeConflict):
+			log.V(1).Info("StackConfigPolicy merge conflict for Elasticsearch", "es_namespace", es.Namespace, "es_name", es.Name, "error", err)
+			results.WithRequeue(defaultRequeue)


I was wondering why do we need to requeue here. Are we not expecting the user to fix the policy? (which would trigger a new reconciliation?)

you are right, the requeue here is redundant and shouldn't happen, the expectation is what you say above, so I am gonna remove it

I removed the redundant requeue in b5eaad2

barkbay · 2025-11-24T12:29:02Z

pkg/controller/stackconfigpolicy/controller.go

+			log.V(1).Info("StackConfigPolicy merge conflict for Elasticsearch", "es_namespace", es.Namespace, "es_name", es.Name, "error", err)
+			results.WithRequeue(defaultRequeue)
+			if esPolicyConfigFinal == nil {
+				continue


In what cases is this path (we have a errMergeConflict but esPolicyConfigFinal is nil) taken? And how the user can understand the above err if it is logged at the debug level?

in the current code there is no path that this combo of errMergeConflict and esPolicyConfigFinal is feasible, however esPolicyConfigFinal can be nil and should be checked, no?! Now this is a Info level log message so why you say debug?

Now this is a Info level log message so why you say debug?

https://github.com/elastic/cloud-on-k8s/blob/main/CONTRIBUTING.md#logging

We only use two levels: debug and info. To produce a log at the debug level use V(1) before the Info call:

logger.V(1).Info("starting reconciliation", "pod", req.NamespacedNamed)

oh that explains it, thanks for the schooling

however esPolicyConfigFinal can be nil and should be checked, no?!

Not necessarily, you can use something like:

func (es *esPolicyConfig) HasErrorForPolicy(policyNsn types.NamespacedName) error { if es == nil { return nil } if err, exists := es.PoliciesWithConflictErrors[policyNsn]; exists { return err } return nil }

ok what you propose still does the nil check but it confines everything in a esPolicyConfig struct func, which improves the code readability so more than happy to go with it

I simplified the merge conflict err handling in b5eaad2 so this is no longer necessary

…r package

… secure settings related secrets

barkbay · 2025-11-26T14:24:56Z

pkg/apis/stackconfigpolicy/v1alpha1/stackconfigpolicy_types.go

+// GetElasticsearchNamespacedSecureSettings returns the Elasticsearch secure settings from this policy
+// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.
+// Returns nil if the policy is nil or has no Elasticsearch secure settings defined.
+func (p *StackConfigPolicy) GetElasticsearchNamespacedSecureSettings() []commonv1.NamespacedSecretSource {
+	if p == nil {
+		return nil
+	}
+
+	ssLen := len(p.Spec.Elasticsearch.SecureSettings)
+	if ssLen == 0 {
+		return nil
+	}
+	pNs := p.GetNamespace()
+	ssNsn := make([]commonv1.NamespacedSecretSource, ssLen)
+	for idx, ss := range p.Spec.Elasticsearch.SecureSettings {
+		ssNsn[idx] = commonv1.NamespacedSecretSource{
+			Namespace:  pNs,
+			SecretName: ss.SecretName,
+			Entries:    ss.Entries,
+		}
+	}
+	return ssNsn
+}
+
+// GetKibanaNamespacedSecureSettings returns the Kibana secure settings from this policy
+// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.
+// Returns nil if the policy is nil or has no Kibana secure settings defined.
+func (p *StackConfigPolicy) GetKibanaNamespacedSecureSettings() []commonv1.NamespacedSecretSource {
+	if p == nil {
+		return nil
+	}
+
+	ssLen := len(p.Spec.Kibana.SecureSettings)
+	if ssLen == 0 {
+		return nil
+	}
+	pNs := p.GetNamespace()
+	ssNsn := make([]commonv1.NamespacedSecretSource, ssLen)
+	for idx, ss := range p.Spec.Kibana.SecureSettings {
+		ssNsn[idx] = commonv1.NamespacedSecretSource{
+			Namespace:  pNs,
+			SecretName: ss.SecretName,
+			Entries:    ss.Entries,
+		}
+	}
+	return ssNsn
+}


nit, duplicated code/logic

Suggested change

// GetElasticsearchNamespacedSecureSettings returns the Elasticsearch secure settings from this policy

// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.

// Returns nil if the policy is nil or has no Elasticsearch secure settings defined.

func (p *StackConfigPolicy) GetElasticsearchNamespacedSecureSettings() []commonv1.NamespacedSecretSource {

if p == nil {

return nil

}

ssLen := len(p.Spec.Elasticsearch.SecureSettings)

if ssLen == 0 {

return nil

}

pNs := p.GetNamespace()

ssNsn := make([]commonv1.NamespacedSecretSource, ssLen)

for idx, ss := range p.Spec.Elasticsearch.SecureSettings {

ssNsn[idx] = commonv1.NamespacedSecretSource{

Namespace: pNs,

SecretName: ss.SecretName,

Entries: ss.Entries,

}

}

return ssNsn

}

// GetKibanaNamespacedSecureSettings returns the Kibana secure settings from this policy

// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.

// Returns nil if the policy is nil or has no Kibana secure settings defined.

func (p *StackConfigPolicy) GetKibanaNamespacedSecureSettings() []commonv1.NamespacedSecretSource {

if p == nil {

return nil

}

ssLen := len(p.Spec.Kibana.SecureSettings)

if ssLen == 0 {

return nil

}

pNs := p.GetNamespace()

ssNsn := make([]commonv1.NamespacedSecretSource, ssLen)

for idx, ss := range p.Spec.Kibana.SecureSettings {

ssNsn[idx] = commonv1.NamespacedSecretSource{

Namespace: pNs,

SecretName: ss.SecretName,

Entries: ss.Entries,

}

}

return ssNsn

}

// GetElasticsearchNamespacedSecureSettings returns the Elasticsearch secure settings from this policy

// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.

// Returns nil if the policy is nil or has no Elasticsearch secure settings defined.

func (p *StackConfigPolicy) GetElasticsearchNamespacedSecureSettings() []commonv1.NamespacedSecretSource {

if p == nil {

return nil

}

return toNamespacedSecretSources(&p.Spec.Elasticsearch, p.Namespace)

}

// GetKibanaNamespacedSecureSettings returns the Kibana secure settings from this policy

// as NamespacedSecretSources, with each secret source namespaced to the policy's namespace.

// Returns nil if the policy is nil or has no Kibana secure settings defined.

func (p *StackConfigPolicy) GetKibanaNamespacedSecureSettings() []commonv1.NamespacedSecretSource {

if p == nil {

return nil

}

return toNamespacedSecretSources(&p.Spec.Kibana, p.Namespace)

}

// HasSecureSettings represents a ConfigPolicySpec that has secure settings.

type HasSecureSettings interface {

GetSecureSettings() []commonv1.SecretSource

}

func toNamespacedSecretSources(hasSecureSettings HasSecureSettings, inNamespace string) []commonv1.NamespacedSecretSource {

secureSettings := hasSecureSettings.GetSecureSettings()

namespacedSecretSources := make([]commonv1.NamespacedSecretSource, len(secureSettings))

for i, s := range secureSettings {

namespacedSecretSources[i] = commonv1.NamespacedSecretSource{

Namespace: inNamespace,

SecretName: s.SecretName,

Entries: s.Entries,

}

}

return namespacedSecretSources

}

func (e *ElasticsearchConfigPolicySpec) GetSecureSettings() []commonv1.SecretSource {

return e.SecureSettings

}

func (k *KibanaConfigPolicySpec) GetSecureSettings() []commonv1.SecretSource {

return k.SecureSettings

}

yep more than a valid point thanks for the proposal

You need to add // +kubebuilder:object:generate=false before the interface, otherwise controller-gen is not happy:

// HasSecureSettings represents a ConfigPolicySpec that has secure settings. // +kubebuilder:object:generate=false type HasSecureSettings interface { GetSecureSettings() []commonv1.SecretSource }

pkoutsovasilis self-assigned this Nov 20, 2025

pkoutsovasilis added the >enhancement Enhancement of existing functionality label Nov 20, 2025

github-actions bot deployed to docs-preview November 20, 2025 12:19 View deployment

pkoutsovasilis force-pushed the feature/multi-scp-composition branch from 1ff62b3 to c442adf Compare November 20, 2025 16:46

github-actions bot deployed to docs-preview November 20, 2025 16:47 View deployment

pkoutsovasilis force-pushed the feature/multi-scp-composition branch 2 times, most recently from f5ee58f to 6353c66 Compare November 21, 2025 11:30

github-actions bot deployed to docs-preview November 21, 2025 11:30 View deployment

pkoutsovasilis force-pushed the feature/multi-scp-composition branch from 6353c66 to 2c4aa4b Compare November 21, 2025 12:01

pkoutsovasilis changed the title ~~[WIP] feat: multi SCP composition~~ feat: multi SCP composition Nov 21, 2025

github-actions bot deployed to docs-preview November 21, 2025 12:01 View deployment

pkoutsovasilis added 2 commits November 21, 2025 14:08

feat: add support for multiple SCP composition

6bba692

ci: add unit-tests

400b02d

pkoutsovasilis force-pushed the feature/multi-scp-composition branch from 2c4aa4b to 400b02d Compare November 21, 2025 12:09

github-actions bot deployed to docs-preview November 21, 2025 12:09 View deployment

pkoutsovasilis added the v3.3.0 (next) label Nov 21, 2025

pkoutsovasilis marked this pull request as ready for review November 21, 2025 12:34

pkoutsovasilis requested review from barkbay, kvalliyurnatt, naemono, pebrc and rhr323 November 21, 2025 12:35

barkbay reviewed Nov 24, 2025

View reviewed changes

pebrc reviewed Nov 24, 2025

View reviewed changes

barkbay reviewed Nov 24, 2025

View reviewed changes

fix: move SoftOwnerRefsAnnotation from commonannotations to reconcile…

dd18a2d

…r package

github-actions bot deployed to docs-preview November 25, 2025 15:16 View deployment

pkoutsovasilis force-pushed the feature/multi-scp-composition branch from 390915d to 98b9439 Compare November 25, 2025 15:42

github-actions bot deployed to docs-preview November 25, 2025 15:43 View deployment

pkoutsovasilis added 2 commits November 25, 2025 18:02

refactor: config policy merging and use namespaced secret sources for…

b5eaad2

… secure settings related secrets

feat: add scp weight as printable column

994a33e

pkoutsovasilis force-pushed the feature/multi-scp-composition branch from 98b9439 to 994a33e Compare November 25, 2025 16:02

github-actions bot deployed to docs-preview November 25, 2025 16:02 View deployment

barkbay reviewed Nov 26, 2025

View reviewed changes

	PoliciesRefs []policyv1alpha1.StackConfigPolicy
	PolicyRefs []policyv1alpha1.StackConfigPolicy

	weightKeyStackPolicies := make(map[int32][]*policyv1alpha1.StackConfigPolicy)
	policiesByWeight := make(map[int32][]*policyv1alpha1.StackConfigPolicy)

feat: multi SCP composition #8917

Are you sure you want to change the base?

feat: multi SCP composition #8917

Conversation

pkoutsovasilis commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Key Features

Weight-Based Priority System

Conflict Detection

Configuration Merging Behaviour

Multi-Soft-Owner Secret Management

Related Issues

Uh oh!

prodsecmachine commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

kvalliyurnatt commented Nov 21, 2025

Uh oh!

barkbay Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pebrc left a comment

Choose a reason for hiding this comment

Uh oh!

pebrc Nov 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pkoutsovasilis commented Nov 20, 2025 •

edited

Loading

prodsecmachine commented Nov 20, 2025 •

edited

Loading

github-actions bot commented Nov 20, 2025 •

edited

Loading

barkbay Nov 24, 2025 •

edited

Loading

pebrc Nov 24, 2025 •

edited

Loading