fix: allow administrator operations on tenant namespaces (#2037)

fix: allow administrator operations on tenant namespaces 

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

api/v1beta2/tenantowner_types.go

@@ -18,8 +18,13 @@ type TenantOwnerSpec struct {
 	// Adds the given subject as capsule user. When enabled this subject does not have to be
 	// mentioned in the CapsuleConfiguration as Capsule User. In almost all scenarios Tenant Owners
 	// must be Capsule Users.
-	//+kubebuilder:default:=true
-	Aggregate bool `json:"aggregate"`
+	// +kubebuilder:default=true
+	// +optional
+	Aggregate *bool `json:"aggregate,omitempty"`
+}
+
+func (s TenantOwnerSpec) AggregateEnabled() bool {
+	return s.Aggregate == nil || *s.Aggregate
 }
 
 // TenantOwnerStatus defines the observed state of TenantOwner.

api/v1beta2/tenantowner_types_test.go

@@ -0,0 +1,49 @@
+// Copyright 2020-2026 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package v1beta2
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"k8s.io/utils/ptr"
+)
+
+func TestTenantOwnerAggregateEnabled(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		aggregate *bool
+		want      bool
+	}{
+		{name: "unset defaults true", want: true},
+		{name: "explicit true", aggregate: ptr.To(true), want: true},
+		{name: "explicit false", aggregate: ptr.To(false), want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			spec := TenantOwnerSpec{Aggregate: tt.aggregate}
+			if got := spec.AggregateEnabled(); got != tt.want {
+				t.Fatalf("AggregateEnabled() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestTenantOwnerAggregateFalseIsSerialized(t *testing.T) {
+	t.Parallel()
+
+	data, err := json.Marshal(TenantOwnerSpec{Aggregate: ptr.To(false)})
+	if err != nil {
+		t.Fatalf("marshal TenantOwnerSpec: %v", err)
+	}
+	if !strings.Contains(string(data), `"aggregate":false`) {
+		t.Fatalf("explicit false was omitted from JSON: %s", data)
+	}
+}

api/v1beta2/zz_generated.deepcopy.go

@@ -1896,6 +1896,11 @@ func (in *TenantOwnerList) DeepCopyObject() runtime.Object {
 func (in *TenantOwnerSpec) DeepCopyInto(out *TenantOwnerSpec) {
 	*out = *in
 	in.CoreOwnerSpec.DeepCopyInto(&out.CoreOwnerSpec)
+	if in.Aggregate != nil {
+		in, out := &in.Aggregate, &out.Aggregate
+		*out = new(bool)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TenantOwnerSpec.