From 139cdadb33ea11129370be53da2654b9f5aa5157 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 31 Aug 2026 13:21:20 +0000 Subject: [PATCH] fix: exclude credential secret from Azure KbsConfig (workaround for trustee-chart#42) On Azure, KBS deployment fails with: Error in creating/updating KBS deployment: Secret "credential" not found trustee-chart's default kbs.extraSecrets (['credential']) is unconditionally added to KbsConfig.spec.kbsSecretResources, but the ACM ConfigurationPolicy that creates that Secret (pull-secret-credential-policy.yaml) is skipped on Azure -- peer-pod CDH doesn't fetch registry credentials from KBS there; pull secrets are distributed to workload namespace SAs instead (see sandboxed-policies-chart/pull-secret-distribution.yaml). Override kbs.extraSecrets: [] in overrides/values-trustee-azure.yaml so KbsConfig on Azure never lists a Secret that will never exist. This is a workaround for the currently-pinned trustee chartVersion (0.10.*). The proper fix (gate extraSecrets in kbs.yaml the same way as the policy) is in validatedpatterns/trustee-chart#42; once merged and released as >= 0.10.1, this override becomes redundant but harmless (both agree extraSecrets should be empty on Azure) and can be dropped in a follow-up. Verified via 'helm template' with both the unfixed (0.10.0, currently published) and fixed trustee-chart templates/kbs.yaml: this override alone removes 'credential' from KbsConfig.spec.kbsSecretResources on Azure in both cases, and does not affect bare metal. --- overrides/values-trustee-azure.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/overrides/values-trustee-azure.yaml b/overrides/values-trustee-azure.yaml index 702cb688..94c92f29 100644 --- a/overrides/values-trustee-azure.yaml +++ b/overrides/values-trustee-azure.yaml @@ -43,3 +43,19 @@ kbs: abiMinor: "31" singleSocket: "false" smtAllowed: "true" + + # trustee-chart's default kbs.extraSecrets (["credential"]) is unconditionally + # added to KbsConfig.spec.kbsSecretResources, but the ACM ConfigurationPolicy + # that creates that Secret (pull-secret-credential-policy.yaml) is skipped on + # Azure -- peer-pod CDH doesn't fetch registry credentials from KBS there + # (pull secrets are distributed to workload namespace SAs instead, see + # sandboxed-policies-chart/pull-secret-distribution.yaml). Without this + # override, KbsConfig lists a Secret ("credential") that never gets created, + # and the kbsconfig-controller fails to deploy KBS with: + # Error in creating/updating KBS deployment: Secret "credential" not found + # + # Fixed upstream in trustee-chart (kbs.yaml now gates extraSecrets the same + # way as the policy) -- see validatedpatterns/trustee-chart#42. This + # override can be dropped once coco-pattern picks up a trustee chartVersion + # that includes that fix (>= 0.10.1, pending release). + extraSecrets: []