fix(ardac2prd): suppress unused Stata secret

[alan-walsh]

Summary

• suppress the Hatchery chart's unused Stata license ExternalSecret in ardac2prd
• avoid a permanent degraded Argo health signal for a workspace type that is not configured

Evidence

• AWS Secrets Manager has no stata-workspace-gen3-license secret
• no live workload references stata-workspace-gen3-license or stata-license.txt
• the exact current Gen3 Helm render removes only that one ExternalSecret
• Guppy still renders normally

Validation

• Gen3 Helm lint passes
• rendered Stata ExternalSecret count changes from 1 to 0
• total rendered ExternalSecret count changes from 16 to 15

Rollout

The Gen3 Application has automated self-heal enabled but automated prune disabled. After this PR merges and Argo reconciles the desired state, delete only default/stata-workspace-gen3-license manually, then verify the Application becomes Synced/Healthy.

[Copilot]

Pull request overview

This PR updates the ardac2prd Hatchery Helm values to avoid rendering an unused Stata license ExternalSecret, preventing persistent degraded Argo health for a workspace type that isn’t configured.

Changes:

• Add a Hatchery externalSecrets override intended to suppress the Stata license ExternalSecret for ardac2prd.
• Document the rationale inline in values.yaml.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[esentuna]

Are we sure add "createK8sStataSecret: true" ? I thought this change removes a secret that is not necessary.

[alan-walsh]

@esentuna Yes, true is intentional, although the field name is misleading. The current Hatchery template is gated by:

{{- if and (.Values.global.externalSecrets.deploy) (not .Values.externalSecrets.createK8sStataSecret) }}

Therefore:

• false (the existing default) makes not false true and renders the failing ExternalSecret.
• true makes not true false and omits the ExternalSecret.

I also searched the current chart: this condition is the only template reference to createK8sStataSecret, so setting it to true does not create a replacement Kubernetes Secret elsewhere. Rendering the exact current chart confirms the Stata ExternalSecret count changes from 1 to 0. Setting it to false would leave behavior unchanged and keep Argo degraded.

The chart value name/documentation should be improved upstream, but for the current chart this is the correct environment override.