fix: pin trustee chart to 0.10.* for azure/trusted-hub, bump airgap mirror to 0.10.2 - #135
Merged
butler54 merged 2 commits intoAug 31, 2026
Conversation
…irror to 0.10.1 values-azure.yaml and values-trusted-hub.yaml were still pinned to chartVersion: 0.9.*, which excludes the 0.10.x line entirely (semver wildcard is minor-scoped). This was stale from before the trustee-chart 0.10.0 OCI-chart migration (PR validatedpatterns#105/validatedpatterns#108), which only touched the baremetal/baremetal-hub values files. The gap matters now: trustee-chart v0.10.1 (validatedpatterns/trustee-chart#41) fixes the Azure RVPS pcr-stash reader, which values-azure.yaml directly layers via overrides/values-trustee-azure.yaml. Azure deployments were pinned out of ever receiving that fix. Also bump the airgap oc-mirror imageset pin (quay.io/validatedpatterns/trustee) from 0.10.0 to 0.10.1 to match, keeping the airgap mirror in sync with the same 0.10.x line the baremetal values files resolve to.
trustee-chart v0.10.2 (validatedpatterns/trustee-chart#40) landed while this PR was open. It adds the bare-metal SNP TCB reference values (snp_bootloader/snp_microcode/snp_snp_svn/snp_tee_svn) that templates/attestation-policy.yaml requires to ever reach hardware: 2 (Affirming) on bare-metal SNP -- directly relevant to this repo's baremetal airgap topology, which the 0.10.* wildcard in values-baremetal.yaml/values-baremetal-hub.yaml already tracks. Superseding the 0.10.1 pin in the same line this PR already touches rather than opening a second PR against it.
butler54
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix: pin trustee chart to 0.10.* for azure/trusted-hub, bump airgap mirror to 0.10.1
values-azure.yaml and values-trusted-hub.yaml were still pinned to
chartVersion: 0.9.*, which excludes the 0.10.x line entirely (semver
wildcard is minor-scoped). This was stale from before the trustee-chart
0.10.0 OCI-chart migration (PR #105/#108), which only touched the
baremetal/baremetal-hub values files.
The gap matters now: trustee-chart v0.10.1 (validatedpatterns/trustee-chart#41)
fixes the Azure RVPS pcr-stash reader, which values-azure.yaml directly
layers via overrides/values-trustee-azure.yaml. Azure deployments were
pinned out of ever receiving that fix.
Also bump the airgap oc-mirror imageset pin (quay.io/validatedpatterns/trustee)
from 0.10.0 to 0.10.1 to match, keeping the airgap mirror in sync with the
same 0.10.x line the baremetal values files resolve to.