From 66305334e7ba8ffc6f2fb2b573334d8caa20dda4 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 31 Aug 2026 15:14:30 +0000 Subject: [PATCH] fix: exclude credential secret from Azure KbsConfig On Azure, KBS deployment fails with: Error in creating/updating KBS deployment: Secret "credential" not found trustee-chart's default kbs.extraSecrets (['credential']) is unconditionally added to KbsConfig.spec.kbsSecretResources, but the ACM ConfigurationPolicy that creates that Secret (pull-secret-credential-policy.yaml) is skipped on Azure -- peer-pod CDH doesn't fetch registry credentials from KBS there. Override kbs.extraSecrets: [] in overrides/values-trustee-azure.yaml so KbsConfig on Azure never lists a Secret that will never exist. Confirmed on a live Azure cluster that sandboxed-policies-chart's pull-secret-distribution mechanism (per-namespace 'pull-secret' Secret + default ServiceAccount imagePullSecrets patch) is already deployed and working -- the KBS-based credential path is genuinely redundant on Azure, not just theoretically unused. This is a workaround for the currently-pinned trustee chartVersion (0.10.*). The proper fix (gate extraSecrets in kbs.yaml the same way as the policy) is in validatedpatterns/trustee-chart#42; once merged and released as >= 0.10.1, this override becomes redundant but harmless and can be dropped. --- overrides/values-trustee-azure.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/overrides/values-trustee-azure.yaml b/overrides/values-trustee-azure.yaml index 702cb688..879921b5 100644 --- a/overrides/values-trustee-azure.yaml +++ b/overrides/values-trustee-azure.yaml @@ -43,3 +43,22 @@ kbs: abiMinor: "31" singleSocket: "false" smtAllowed: "true" + + # trustee-chart's default kbs.extraSecrets (["credential"]) is unconditionally + # added to KbsConfig.spec.kbsSecretResources, but the ACM ConfigurationPolicy + # that creates that Secret (pull-secret-credential-policy.yaml) is skipped on + # Azure -- peer-pod CDH doesn't fetch registry credentials from KBS there. + # Without this override, KbsConfig lists a Secret ("credential") that never + # gets created, and the kbsconfig-controller fails to deploy KBS with: + # Error in creating/updating KBS deployment: Secret "credential" not found + # + # Confirmed on a live Azure cluster that image pulls already work via + # sandboxed-policies-chart's pull-secret-distribution mechanism + # (per-namespace 'pull-secret' Secret + default ServiceAccount + # imagePullSecrets patch) -- the KBS 'credential' resource is genuinely + # unnecessary on Azure, not just unused. + # + # Fixed upstream in trustee-chart -- see validatedpatterns/trustee-chart#42. + # This override can be dropped once coco-pattern picks up a trustee + # chartVersion that includes that fix (>= 0.10.1, pending release). + extraSecrets: []