From a066c8ff800372abf3ca34e9ae27095eff54aea2 Mon Sep 17 00:00:00 2001 From: Deniz Tas Date: Mon, 5 Oct 2026 14:21:18 +0200 Subject: [PATCH] fix: use upsert at index 1 instead of append for tls_pem in enable-identity-aware-routing --- operations/enable-identity-aware-routing.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/operations/enable-identity-aware-routing.yml b/operations/enable-identity-aware-routing.yml index 65b84208c..7caa3f16b 100644 --- a/operations/enable-identity-aware-routing.yml +++ b/operations/enable-identity-aware-routing.yml @@ -24,9 +24,12 @@ forwarded_client_cert: sanitize_set xfcc_format: envoy -# Add *.apps.identity TLS cert to gorouter (served via SNI) +# Add *.apps.identity TLS cert to gorouter (served via SNI). +# Uses index 1? (upsert) instead of /- (append) to work both with the base manifest +# (tls_pem is a single-entry array) and with use-operator-provided-router-tls-certificates.yml +# (tls_pem is replaced with an unresolved variable reference that /- cannot append to). - type: replace - path: /instance_groups/name=router/jobs/name=gorouter/properties/router/tls_pem/- + path: /instance_groups/name=router/jobs/name=gorouter/properties/router/tls_pem/1? value: cert_chain: ((apps_identity_router_tls.certificate)) private_key: ((apps_identity_router_tls.private_key))