{"id":51418822,"url":"https://github.com/appthrust/ocm-managed-serviceaccount-replicaset-controller","last_synced_at":"2026-07-04T22:30:46.057Z","repository":{"id":355013409,"uuid":"1226355843","full_name":"appthrust/ocm-managed-serviceaccount-replicaset-controller","owner":"appthrust","description":"High-level OCM ManagedServiceAccount fan-out operator","archived":false,"fork":false,"pushed_at":"2026-05-04T07:22:28.000Z","size":98,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-04T08:13:03.176Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/appthrust.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"docs/security-considerations.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":"AGENTS.md","dco":null,"cla":null}},"created_at":"2026-05-01T09:37:28.000Z","updated_at":"2026-05-04T07:22:06.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/appthrust/ocm-managed-serviceaccount-replicaset-controller","commit_stats":null,"previous_names":["appthrust/ocm-managed-serviceaccount-set-operator","appthrust/ocm-managed-serviceaccount-replicaset-controller"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/appthrust/ocm-managed-serviceaccount-replicaset-controller","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Focm-managed-serviceaccount-replicaset-controller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Focm-managed-serviceaccount-replicaset-controller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Focm-managed-serviceaccount-replicaset-controller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Focm-managed-serviceaccount-replicaset-controller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/appthrust","download_url":"https://codeload.github.com/appthrust/ocm-managed-serviceaccount-replicaset-controller/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Focm-managed-serviceaccount-replicaset-controller/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35138074,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-04T22:30:45.969Z","updated_at":"2026-07-04T22:30:46.044Z","avatar_url":"https://github.com/appthrust.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# OCM ManagedServiceAccount ReplicaSet Controller\n\nOCM ManagedServiceAccount ReplicaSet Controller is a hub-side controller for\ncreating OCM `ManagedServiceAccount` resources across clusters selected by OCM\nPlacement output.\n\nThe upstream `ManagedServiceAccount` API is per managed cluster namespace. It\ndoes not support creating one `ManagedServiceAccount` in a cluster-set namespace\nand having it apply to every cluster in the set. This controller fills that gap\nwith `ManagedServiceAccountReplicaSet`.\n\n## What It Does\n\n`ManagedServiceAccountReplicaSet` provides an OCM-native workflow for\nreplicating managed service accounts across a selected fleet:\n\n- Resolves target clusters from OCM `Placement` and `PlacementDecision`\n  output using the OCM placement SDK tracker.\n- Supports OCM-style `rolloutStrategy` per placement ref.\n- Reports OCM-style rollout progress counts for updating, succeeded, failed,\n  and timed-out clusters.\n- Creates one generated OCM `ManagedServiceAccount` per selected managed\n  cluster namespace.\n- Optionally delivers typed, least-privilege remote RBAC through generated OCM\n  `ManifestWork` objects.\n- Cleans generated cross-namespace children with explicit finalizers.\n\n## Get Started\n\nInstall the controller on an OCM hub, point a\n`ManagedServiceAccountReplicaSet` at an existing OCM `Placement`, and let the\ncontroller reconcile generated hub-side children for each selected managed\ncluster. The included sample shows a complete replica set with service account\nrotation and typed remote RBAC grants:\n\n- [Getting started](docs/getting-started.md) for the end-to-end flow.\n- [Helm installation](docs/helm.md) for chart options and production values.\n- [Sample ManagedServiceAccountReplicaSet](config/samples/authentication_v1alpha1_managedserviceaccountreplicaset.yaml)\n\n## Additional Documentation\n\n- [API reference](docs/api-reference.md)\n- [Placement behavior](docs/placement.md)\n- [Operations](docs/operations.md)\n- [Troubleshooting](docs/troubleshooting.md)\n- [Security model](docs/security.md)\n- [Admission policy](docs/admission-policy.md)\n- [Supply chain](docs/supply-chain.md)\n- [Observability](docs/observability.md)\n- [Compatibility](docs/compatibility.md)\n\n## Controller Guarantees\n\nThe controller intentionally avoids direct remote-cluster access. It does not\nread Cluster API `Cluster` objects, remote kubeconfig Secrets, or child status\nsubresources, and it only writes the status of `ManagedServiceAccountReplicaSet`.\n\n## Checks\n\n```sh\nmake test\nmake lint\nmake helm-lint\nmake test-chart\nmake test-e2e\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappthrust%2Focm-managed-serviceaccount-replicaset-controller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fappthrust%2Focm-managed-serviceaccount-replicaset-controller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappthrust%2Focm-managed-serviceaccount-replicaset-controller/lists"}