From 4acb3d2cb57146daa470c0d57008af4887aa4808 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 22:36:32 +0000 Subject: [PATCH 01/14] feat(14-03): update operator CSV pins and trustee chartVersion for OSC 1.13 / Trustee 1.2 - Bump sandboxed-containers-operator CSV from v1.12.0 to v1.13.0 (baremetal, azure) - Bump trustee-operator CSV from v1.1.0 to v1.2.0 (baremetal, azure, trusted-hub) - Update trustee chartVersion from 0.8.* to 0.9.* across all topologies - Add targetRevision: dev/osc-1.13-upgrade to baremetal trustee application for testing - Preserve sandbox/policies chartVersion at 0.2.* (D-10, D-11) - Preserve workload chart paths unchanged (D-12) --- values-azure.yaml | 6 +++--- values-baremetal.yaml | 7 ++++--- values-trusted-hub.yaml | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) diff --git a/values-azure.yaml b/values-azure.yaml index 48c5d703..46cd037b 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -36,13 +36,13 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 trustee: name: trustee-operator namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -87,7 +87,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: diff --git a/values-baremetal.yaml b/values-baremetal.yaml index 0d037ace..f23e70a2 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -41,7 +41,7 @@ clusterGroup: namespace: openshift-sandboxed-containers-operator channel: stable installPlanApproval: Manual - csv: sandboxed-containers-operator.v1.12.0 + csv: sandboxed-containers-operator.v1.13.0 annotations: argocd.argoproj.io/sync-wave: "10" trustee: @@ -49,7 +49,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 annotations: argocd.argoproj.io/sync-wave: "10" cert-manager: @@ -164,7 +164,8 @@ clusterGroup: annotations: argocd.argoproj.io/sync-wave: "20" chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* + targetRevision: dev/osc-1.13-upgrade extraValueFiles: - '/overrides/values-trustee.yaml' overrides: diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml index a54f1a48..4037e9af 100644 --- a/values-trusted-hub.yaml +++ b/values-trusted-hub.yaml @@ -31,7 +31,7 @@ clusterGroup: namespace: trustee-operator-system channel: stable installPlanApproval: Manual - csv: trustee-operator.v1.1.0 + csv: trustee-operator.v1.2.0 cert-manager: name: openshift-cert-manager-operator namespace: cert-manager-operator @@ -77,7 +77,7 @@ clusterGroup: namespace: trustee-operator-system project: trustee chart: trustee - chartVersion: 0.8.* + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: From 08c6537a1585b75d3436b8afa505e025f7495180 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 23:43:09 +0000 Subject: [PATCH 02/14] fix: remove dead admin auth keypair generation and secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trustee 1.2 uses authorization_mode = "DenyAll" — no admin API access exists. Remove the now-unused: - kbsPublicKey and kbsPrivateKey from values-secret template - ed25519 keypair generation from gen-secrets.sh Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/gen-secrets.sh | 9 --------- values-secret.yaml.template | 17 ----------------- 2 files changed, 26 deletions(-) diff --git a/scripts/gen-secrets.sh b/scripts/gen-secrets.sh index 16c35807..adeeb636 100755 --- a/scripts/gen-secrets.sh +++ b/scripts/gen-secrets.sh @@ -4,8 +4,6 @@ echo "Creating secrets as required" echo COCO_SECRETS_DIR="${HOME}/.coco-pattern" -KBS_PRIVATE_KEY="${COCO_SECRETS_DIR}/kbsPrivateKey" -KBS_PUBLIC_KEY="${COCO_SECRETS_DIR}/kbsPublicKey" SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" VALUES_FILE="${HOME}/values-secret-coco-pattern.yaml" @@ -21,13 +19,6 @@ if [ "${COCO_ENABLE_SSH_DEBUG:-false}" = "true" ]; then fi fi -if [ ! -f "${KBS_PRIVATE_KEY}" ]; then - echo "Creating kbs keys" - rm -f "${KBS_PUBLIC_KEY}" - openssl genpkey -algorithm ed25519 >${KBS_PRIVATE_KEY} - openssl pkey -in "${KBS_PRIVATE_KEY}" -pubout -out "${KBS_PUBLIC_KEY}" -fi - ## PCCS secrets for bare metal Intel TDX deployments PCCS_PRIVATE_KEY="${COCO_SECRETS_DIR}/pccs_private.pem" PCCS_CERTIFICATE="${COCO_SECRETS_DIR}/pccs_certificate.pem" diff --git a/values-secret.yaml.template b/values-secret.yaml.template index 1afb92d0..732728fb 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -11,23 +11,6 @@ secrets: # Core KBS Secrets (Always Required) # =================================================================== - # KBS public key - used by workloads to verify KBS identity - - name: kbsPublicKey - vaultPrefixes: - - hub - fields: - - name: publicKey - path: ~/.coco-pattern/kbsPublicKey - - # KBS private key - used by KBS to sign responses - # Generated by gen-secrets.sh alongside kbsPublicKey - - name: kbsPrivateKey - vaultPrefixes: - - global - fields: - - name: privateKey - path: ~/.coco-pattern/kbsPrivateKey - # Auto-generated test secrets provided by KBS - name: kbsres1 vaultPrefixes: From 2569c166573a2f86a8ae9667893496c2c878cd10 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 17 Jul 2026 01:25:49 +0000 Subject: [PATCH 03/14] fix: remove PCCS collateralService override for direct Intel attestation (D-01) - Remove kbs.tdx.collateralService override pointing to local PCCS - Chart default (api.trustedservices.intel.com) takes effect per D-01 --- values-baremetal.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/values-baremetal.yaml b/values-baremetal.yaml index f23e70a2..fc8c0077 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -173,8 +173,6 @@ clusterGroup: value: "true" - name: kbs.tdx.enabled value: "true" - - name: kbs.tdx.collateralService - value: "https://pccs-service.intel-dcap.svc.cluster.local:8042/sgx/certification/v4/" - name: kbs.gpu.enabled value: "true" - name: kbs.baremetal.enabled From 0201af87f35ec4e0c9d3bf1aa958cf116af74a36 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 17 Jul 2026 04:55:45 +0000 Subject: [PATCH 04/14] fix: switch trustee chart to git-based ref for dev testing Trustee chart 0.9.0 not yet published to charts.validatedpatterns.io (latest is 0.8.0). Switch from chart/chartVersion to repoURL/path pointing at butler54/trustee-chart dev/osc-1.13-upgrade branch, same pattern used during Milestone 1 testing (f228913). Co-Authored-By: Claude Opus 4.6 (1M context) --- values-baremetal.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/values-baremetal.yaml b/values-baremetal.yaml index fc8c0077..d9f45f9a 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -163,9 +163,9 @@ clusterGroup: project: trustee annotations: argocd.argoproj.io/sync-wave: "20" - chart: trustee - chartVersion: 0.9.* + repoURL: https://github.com/butler54/trustee-chart.git targetRevision: dev/osc-1.13-upgrade + path: . extraValueFiles: - '/overrides/values-trustee.yaml' overrides: From 7e303e64539612454a06023ea4688fd0f69c3f32 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Fri, 17 Jul 2026 22:41:12 +0000 Subject: [PATCH 05/14] feat: add JWK signing key generation for sealed secrets - gen-secrets.sh: generate P-256 EC JWK keypair using jose CLI (RHEL appstream package, C/OpenSSL based, not custom code) - values-secret.yaml.template: add sealedSecretsSigningKey secret that provisions the public key to Vault for ESO sync to KBS Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/gen-secrets.sh | 16 ++++++++++++++++ values-secret.yaml.template | 11 +++++++++++ 2 files changed, 27 insertions(+) diff --git a/scripts/gen-secrets.sh b/scripts/gen-secrets.sh index adeeb636..32d04187 100755 --- a/scripts/gen-secrets.sh +++ b/scripts/gen-secrets.sh @@ -19,6 +19,22 @@ if [ "${COCO_ENABLE_SSH_DEBUG:-false}" = "true" ]; then fi fi +## JWK signing key for sealed secrets (P-256 EC key) +JWK_SIGNING_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing.jwk" +JWK_PUBLIC_KEY="${COCO_SECRETS_DIR}/sealed-secrets-signing-pub.jwk" + +if [ ! -f "${JWK_SIGNING_KEY}" ]; then + if command -v jose >/dev/null 2>&1; then + echo "Creating sealed secrets JWK signing key (P-256 EC) using jose" + jose jwk gen -i '{"alg":"ES256","kid":"coco-signing-key","use":"sig"}' -o "${JWK_SIGNING_KEY}" + jose jwk pub -i "${JWK_SIGNING_KEY}" -o "${JWK_PUBLIC_KEY}" + else + echo "ERROR: jose CLI not found. Install with: sudo dnf install jose" + echo "The jose package is available in rhel-10-for-x86_64-appstream-rpms" + exit 1 + fi +fi + ## PCCS secrets for bare metal Intel TDX deployments PCCS_PRIVATE_KEY="${COCO_SECRETS_DIR}/pccs_private.pem" PCCS_CERTIFICATE="${COCO_SECRETS_DIR}/pccs_certificate.pem" diff --git a/values-secret.yaml.template b/values-secret.yaml.template index 732728fb..a0671453 100644 --- a/values-secret.yaml.template +++ b/values-secret.yaml.template @@ -151,6 +151,17 @@ secrets: } } + # JWK signing key for sealed secrets + # The public key is provisioned to KBS for signature verification. + # The private key stays local and is used to create sealed secrets. + # Generated by: ./scripts/gen-secrets.sh (requires jose CLI) + - name: sealedSecretsSigningKey + vaultPrefixes: + - hub + fields: + - name: public + path: ~/.coco-pattern/sealed-secrets-signing-pub.jwk + # Sigstore public keys for Red Hat container signature verification # Red Hat release key 3 (used for sigstore signatures as of Oct 2024) - name: sigstore-keys From 75d663c3e7e9fe6d351d0fd5fd5b12c02affc8f0 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Sun, 19 Jul 2026 13:17:29 +0000 Subject: [PATCH 06/14] fix(16-01): update RHDP scripts for Phase 4 simple-to-azure rename - wrapper.sh: change clusterGroupName validation from "simple" to "azure" - rhdp-cluster-define.py: change values-simple.yaml assertion to values-azure.yaml - Both scripts now match the Phase 4 topology rename (values-simple.yaml -> values-azure.yaml) Co-Authored-By: Claude Opus 4.6 (1M context) --- rhdp/rhdp-cluster-define.py | 2 +- rhdp/wrapper.sh | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/rhdp/rhdp-cluster-define.py b/rhdp/rhdp-cluster-define.py index b65cb4b3..ddc9ed00 100644 --- a/rhdp/rhdp-cluster-define.py +++ b/rhdp/rhdp-cluster-define.py @@ -78,7 +78,7 @@ def cleanup(pattern_dir: pathlib.Path, cluster_configs: List[Dict]) -> None: def validate_dir(): """Simple validation for directory""" assert pathlib.Path("values-global.yaml").exists() - assert pathlib.Path("values-simple.yaml").exists() + assert pathlib.Path("values-azure.yaml").exists() def setup_install( diff --git a/rhdp/wrapper.sh b/rhdp/wrapper.sh index 6c6cc539..c0d7bf27 100755 --- a/rhdp/wrapper.sh +++ b/rhdp/wrapper.sh @@ -97,14 +97,14 @@ fi # Extract clusterGroupName from values-global.yaml using yq CLUSTER_GROUP_NAME=$(yq eval '.main.clusterGroupName' values-global.yaml) -if [ "$CLUSTER_GROUP_NAME" != "simple" ]; then +if [ "$CLUSTER_GROUP_NAME" != "azure" ]; then echo "ERROR: Incorrect clusterGroupName configuration" - echo "Expected: simple" + echo "Expected: azure" echo "Found: $CLUSTER_GROUP_NAME" echo "" echo "Please update values-global.yaml:" echo " main:" - echo " clusterGroupName: simple" + echo " clusterGroupName: azure" exit 1 fi From a81f0d2354d86686d69c7fea762bd22eb8a17b12 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Sun, 19 Jul 2026 13:18:00 +0000 Subject: [PATCH 07/14] fix(16-01): update coco-tools container to 1.13 for OSC 1.13 firmware measurements - collect-firmware-refvals.sh: bump CONTAINER_IMAGE from coco-tools:1.12 to coco-tools:1.13 - Ensures veritas computes firmware measurements matching OSC 1.13 peer-pod artifacts - RVPS transformation pipeline (array-to-object) unchanged -- already compatible with Phase 14 format Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/collect-firmware-refvals.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/collect-firmware-refvals.sh b/scripts/collect-firmware-refvals.sh index 708cf40d..de4ed7be 100755 --- a/scripts/collect-firmware-refvals.sh +++ b/scripts/collect-firmware-refvals.sh @@ -28,7 +28,7 @@ PULL_SECRET="${HOME}/pull-secret.json" OCP_VERSION="" OSC_VERSION="" TEE="tdx" -CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:1.12" +CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:1.13" # Parse arguments while [[ $# -gt 0 ]]; do From 2f143ea0875960fe877a3ad808a51da631dd90c0 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Sun, 19 Jul 2026 22:56:58 +0000 Subject: [PATCH 08/14] fix(16): coco-tools 0.5.1 and --tee snp for Azure - coco-tools tag is 0.5.1 (not version-matched to OSC) - wrapper.sh now passes --tee snp for Azure platform Co-Authored-By: Claude Opus 4.6 (1M context) --- rhdp/wrapper.sh | 2 +- scripts/collect-firmware-refvals.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rhdp/wrapper.sh b/rhdp/wrapper.sh index c0d7bf27..1016174c 100755 --- a/rhdp/wrapper.sh +++ b/rhdp/wrapper.sh @@ -189,7 +189,7 @@ bash ./scripts/gen-secrets.sh echo "---------------------" echo "retrieving PCR measurements" echo "---------------------" -bash ./scripts/collect-firmware-refvals.sh --platform azure +bash ./scripts/collect-firmware-refvals.sh --platform azure --tee snp sleep 60 echo "---------------------" diff --git a/scripts/collect-firmware-refvals.sh b/scripts/collect-firmware-refvals.sh index de4ed7be..4c2c6db2 100755 --- a/scripts/collect-firmware-refvals.sh +++ b/scripts/collect-firmware-refvals.sh @@ -28,7 +28,7 @@ PULL_SECRET="${HOME}/pull-secret.json" OCP_VERSION="" OSC_VERSION="" TEE="tdx" -CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:1.13" +CONTAINER_IMAGE="quay.io/openshift_sandboxed_containers/coco-tools:0.5.1" # Parse arguments while [[ $# -gt 0 ]]; do From 9690557215657ec00003d62654a10767e79659d1 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Sun, 19 Jul 2026 23:49:47 +0000 Subject: [PATCH 09/14] fix(16): use --image-tag not --osc-version for veritas 0.5.1 veritas in coco-tools:0.5.1 uses --image-tag, not --osc-version. Co-Authored-By: Claude Opus 4.6 (1M context) --- scripts/collect-firmware-refvals.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/collect-firmware-refvals.sh b/scripts/collect-firmware-refvals.sh index 4c2c6db2..d4356cde 100755 --- a/scripts/collect-firmware-refvals.sh +++ b/scripts/collect-firmware-refvals.sh @@ -117,7 +117,7 @@ if [ "$PLATFORM" = "azure" ]; then OSC_VERSION="latest" fi fi - VERSION_ARGS="--osc-version $OSC_VERSION" + VERSION_ARGS="--image-tag $OSC_VERSION" VERSION_DISPLAY="OSC $OSC_VERSION" else if [ -z "$OCP_VERSION" ]; then From ec83c09a43df303e80e360a558fc4c9546007b88 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 20 Jul 2026 11:03:12 +0000 Subject: [PATCH 10/14] fix(16): align Azure values with baremetal dev branch strategy - trustee: use git-based ref (butler54/trustee-chart dev/osc-1.13-upgrade) instead of published chart 0.9.* which doesn't exist yet - kbs-access: split into kbs-access-curl + kbs-access-sealed (Phase 5 rename) Co-Authored-By: Claude Opus 4.6 (1M context) --- values-azure.yaml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/values-azure.yaml b/values-azure.yaml index 46cd037b..107e3710 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -86,8 +86,9 @@ clusterGroup: name: trustee namespace: trustee-operator-system project: trustee - chart: trustee - chartVersion: 0.9.* + repoURL: https://github.com/butler54/trustee-chart.git + targetRevision: dev/osc-1.13-upgrade + path: . extraValueFiles: - '/overrides/values-trustee.yaml' overrides: @@ -119,11 +120,20 @@ clusterGroup: automated: prune: true - kbs-access: - name: kbs-access + kbs-access-curl: + name: kbs-access-curl namespace: kbs-access project: workloads - path: charts/coco-supported/kbs-access + path: charts/coco-supported/kbs-access-curl + syncPolicy: + automated: + prune: true + + kbs-access-sealed: + name: kbs-access-sealed + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-sealed syncPolicy: automated: prune: true From 184a73f1d00d6efeaafa4ab4dcf4d0ef5293d612 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Mon, 20 Jul 2026 11:05:00 +0000 Subject: [PATCH 11/14] fix(16): replace kbs-access with kbs-access-curl/sealed in azure-spoke Co-Authored-By: Claude Opus 4.6 (1M context) --- values-azure-spoke.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/values-azure-spoke.yaml b/values-azure-spoke.yaml index 43cd34d9..ceb6252f 100644 --- a/values-azure-spoke.yaml +++ b/values-azure-spoke.yaml @@ -74,11 +74,17 @@ clusterGroup: project: workloads path: charts/coco-supported/hello-openshift - kbs-access: - name: kbs-access + kbs-access-curl: + name: kbs-access-curl namespace: kbs-access project: workloads - path: charts/coco-supported/kbs-access + path: charts/coco-supported/kbs-access-curl + + kbs-access-sealed: + name: kbs-access-sealed + namespace: kbs-access + project: workloads + path: charts/coco-supported/kbs-access-sealed imperative: jobs: From 481ae1fefc47b27d9373ac846e39503036511214 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Tue, 21 Jul 2026 01:48:27 +0000 Subject: [PATCH 12/14] fix(16): use git-based ref for sandboxed-policies-chart on Azure Switch from published Helm chart (0.2.*) to git fork (dev/phase1-testing) to pick up pull-secret distribution policy. Co-Authored-By: Claude Opus 4.6 (1M context) --- values-azure.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/values-azure.yaml b/values-azure.yaml index 107e3710..c88660c1 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -104,8 +104,9 @@ clusterGroup: name: sandbox-policies namespace: openshift-sandboxed-containers-operator project: sandbox - chart: sandboxed-policies - chartVersion: 0.2.* + repoURL: https://github.com/butler54/sandboxed-policies-chart.git + targetRevision: dev/phase1-testing + path: . overrides: - name: global.coco.azure.tags value: "key1=value1,key2=value2" From ef35425893ed880e1e684c65d058d4c600c74114 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Tue, 21 Jul 2026 03:57:01 +0000 Subject: [PATCH 13/14] docs(16): clarify authenticated_registry_credentials_uri is baremetal-only On Azure peer-pods (kata-remote), CDH does not use this KBS URI for registry auth. Pull secrets go to workload SAs via ACM policy instead. URI kept for baremetal kata where CDH fetches credentials from KBS. Co-Authored-By: Claude Opus 4.6 (1M context) --- ansible/initdata-debug.toml.tpl | 4 ++++ ansible/initdata-default.toml.tpl | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/ansible/initdata-debug.toml.tpl b/ansible/initdata-debug.toml.tpl index a463c3b2..65ea6302 100644 --- a/ansible/initdata-debug.toml.tpl +++ b/ansible/initdata-debug.toml.tpl @@ -24,6 +24,10 @@ kbs_cert = """{{ trustee_cert }}""" [image] image_security_policy_uri = 'kbs:///default/security-policy/{{ security_policy_flavour }}' +# On baremetal (kata), CDH fetches this credential from KBS to authenticate +# with container registries inside the CVM. On Azure peer-pods (kata-remote), +# CDH does NOT use this URI — registry auth is handled via imagePullSecrets +# on the workload's service account instead. Kept here for baremetal support. authenticated_registry_credentials_uri = 'kbs:///default/credential/regcred' ''' diff --git a/ansible/initdata-default.toml.tpl b/ansible/initdata-default.toml.tpl index daf579bf..d66cdcf7 100644 --- a/ansible/initdata-default.toml.tpl +++ b/ansible/initdata-default.toml.tpl @@ -24,6 +24,10 @@ kbs_cert = """{{ trustee_cert }}""" [image] image_security_policy_uri = 'kbs:///default/security-policy/{{ security_policy_flavour }}' +# On baremetal (kata), CDH fetches this credential from KBS to authenticate +# with container registries inside the CVM. On Azure peer-pods (kata-remote), +# CDH does NOT use this URI — registry auth is handled via imagePullSecrets +# on the workload's service account instead. Kept here for baremetal support. authenticated_registry_credentials_uri = 'kbs:///default/credential/regcred' ''' From 374102e5fed402f29cb3c732158b04abea39a705 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Tue, 21 Jul 2026 05:12:39 +0000 Subject: [PATCH 14/14] feat: switch to released chart versions (trustee 0.9, policies 0.3) Update values-azure.yaml and values-baremetal.yaml to reference published chart releases instead of git-based dev branch refs. - trustee: chartVersion 0.9.* (was git ref to dev/osc-1.13-upgrade) - sandboxed-policies: chartVersion 0.3.* (was git ref to dev/phase1-testing) Co-Authored-By: Claude Opus 4.6 (1M context) --- values-azure.yaml | 10 ++++------ values-baremetal.yaml | 5 ++--- 2 files changed, 6 insertions(+), 9 deletions(-) diff --git a/values-azure.yaml b/values-azure.yaml index c88660c1..9bf6ffa5 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -86,9 +86,8 @@ clusterGroup: name: trustee namespace: trustee-operator-system project: trustee - repoURL: https://github.com/butler54/trustee-chart.git - targetRevision: dev/osc-1.13-upgrade - path: . + chart: trustee + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: @@ -104,9 +103,8 @@ clusterGroup: name: sandbox-policies namespace: openshift-sandboxed-containers-operator project: sandbox - repoURL: https://github.com/butler54/sandboxed-policies-chart.git - targetRevision: dev/phase1-testing - path: . + chart: sandboxed-policies + chartVersion: 0.3.* overrides: - name: global.coco.azure.tags value: "key1=value1,key2=value2" diff --git a/values-baremetal.yaml b/values-baremetal.yaml index d9f45f9a..9d984cac 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -163,9 +163,8 @@ clusterGroup: project: trustee annotations: argocd.argoproj.io/sync-wave: "20" - repoURL: https://github.com/butler54/trustee-chart.git - targetRevision: dev/osc-1.13-upgrade - path: . + chart: trustee + chartVersion: 0.9.* extraValueFiles: - '/overrides/values-trustee.yaml' overrides: