From 0a448963e3be7055d45bf0aec9e604a6bb384085 Mon Sep 17 00:00:00 2001 From: Kirill Ilin Date: Fri, 6 Nov 2026 18:29:18 +0500 Subject: [PATCH] docs(installer): say a CA-only cert secret must be Opaque kubernetes.io/tls requires both tls.crt and tls.key, so a Secret that carries only ca.crt is rejected under that type. Assisted-by: LLM Signed-off-by: Kirill Ilin --- packages/core/installer/values.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/packages/core/installer/values.yaml b/packages/core/installer/values.yaml index 6224b5955..55f19c0d9 100644 --- a/packages/core/installer/values.yaml +++ b/packages/core/installer/values.yaml @@ -65,8 +65,9 @@ cozystackOperator: platformSourceSecret: '' # Name of the Secret in cozy-system namespace with TLS material for an OCI # platform source: `ca.crt` for a registry whose certificate is issued by a - # private CA, and/or `tls.crt`+`tls.key` for client certificate auth (type - # Opaque or kubernetes.io/tls). When non-empty, sets spec.certSecretRef on the + # private CA, and/or `tls.crt`+`tls.key` for client certificate auth. A + # CA-only Secret must be type Opaque: kubernetes.io/tls requires `tls.crt` + # and `tls.key`. When non-empty, sets spec.certSecretRef on the # generated OCIRepository; the operator rewrites that object on every start, # so a certSecretRef patched onto it by hand does not survive a restart. # The cozystack-packages source copies the spec, so it inherits the CA too.