From 7e8d1eb0d18a22d69a163fde3562567890b15979 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 31 Aug 2026 10:02:37 +0000 Subject: [PATCH 1/2] fix: pin trustee chart to 0.10.* for azure/trusted-hub, bump airgap mirror to 0.10.1 values-azure.yaml and values-trusted-hub.yaml were still pinned to chartVersion: 0.9.*, which excludes the 0.10.x line entirely (semver wildcard is minor-scoped). This was stale from before the trustee-chart 0.10.0 OCI-chart migration (PR #105/#108), which only touched the baremetal/baremetal-hub values files. The gap matters now: trustee-chart v0.10.1 (validatedpatterns/trustee-chart#41) fixes the Azure RVPS pcr-stash reader, which values-azure.yaml directly layers via overrides/values-trustee-azure.yaml. Azure deployments were pinned out of ever receiving that fix. Also bump the airgap oc-mirror imageset pin (quay.io/validatedpatterns/trustee) from 0.10.0 to 0.10.1 to match, keeping the airgap mirror in sync with the same 0.10.x line the baremetal values files resolve to. --- airgap/imageset-config-4.22.yaml | 2 +- values-azure.yaml | 2 +- values-trusted-hub.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/airgap/imageset-config-4.22.yaml b/airgap/imageset-config-4.22.yaml index f83c974f..c3d2cb23 100644 --- a/airgap/imageset-config-4.22.yaml +++ b/airgap/imageset-config-4.22.yaml @@ -116,7 +116,7 @@ mirror: - name: quay.io/validatedpatterns/acm:0.1.27 - name: quay.io/validatedpatterns/hashicorp-vault:0.1.8 - name: quay.io/validatedpatterns/openshift-external-secrets:0.0.4 - - name: quay.io/validatedpatterns/trustee:0.10.0 + - name: quay.io/validatedpatterns/trustee:0.10.1 - name: quay.io/validatedpatterns/sandboxed-containers:0.2.1 - name: quay.io/validatedpatterns/sandboxed-policies:0.2.0 diff --git a/values-azure.yaml b/values-azure.yaml index 39b6c865..ca15b9fd 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -87,7 +87,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.9.* + chartVersion: 0.10.* extraValueFiles: - '/overrides/values-trustee.yaml' - '/overrides/values-trustee-azure.yaml' diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml index 4037e9af..f0a48e36 100644 --- a/values-trusted-hub.yaml +++ b/values-trusted-hub.yaml @@ -77,7 +77,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.9.* + chartVersion: 0.10.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: From 99915565e6f3b0fb79027e61bcc4aaa9263b4b21 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 31 Aug 2026 10:37:10 +0000 Subject: [PATCH 2/2] fix: bump airgap mirror pin to trustee 0.10.2 trustee-chart v0.10.2 (validatedpatterns/trustee-chart#40) landed while this PR was open. It adds the bare-metal SNP TCB reference values (snp_bootloader/snp_microcode/snp_snp_svn/snp_tee_svn) that templates/attestation-policy.yaml requires to ever reach hardware: 2 (Affirming) on bare-metal SNP -- directly relevant to this repo's baremetal airgap topology, which the 0.10.* wildcard in values-baremetal.yaml/values-baremetal-hub.yaml already tracks. Superseding the 0.10.1 pin in the same line this PR already touches rather than opening a second PR against it. --- airgap/imageset-config-4.22.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/airgap/imageset-config-4.22.yaml b/airgap/imageset-config-4.22.yaml index c3d2cb23..9065b06e 100644 --- a/airgap/imageset-config-4.22.yaml +++ b/airgap/imageset-config-4.22.yaml @@ -116,7 +116,7 @@ mirror: - name: quay.io/validatedpatterns/acm:0.1.27 - name: quay.io/validatedpatterns/hashicorp-vault:0.1.8 - name: quay.io/validatedpatterns/openshift-external-secrets:0.0.4 - - name: quay.io/validatedpatterns/trustee:0.10.1 + - name: quay.io/validatedpatterns/trustee:0.10.2 - name: quay.io/validatedpatterns/sandboxed-containers:0.2.1 - name: quay.io/validatedpatterns/sandboxed-policies:0.2.0