From de60efbd157661a3a84de84f36e6252a4a2a6635 Mon Sep 17 00:00:00 2001 From: Ivan Okhotnikov Date: Wed, 1 Jul 2026 09:40:04 +0300 Subject: [PATCH] fix(apps/kubernetes): normalize Job also clears stale extraArgs and extraVolumeMounts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to the KCP cleanup extension: Kamaji's SSA field manager takes ownership of `spec.apiServer.extraArgs` and `spec.apiServer.extraVolumeMounts` too, not just `spec.deployment.extraVolumes`. The previous normalize patch only replaced extraVolumes; the two remaining fields still carried the `--authentication-config=` flag and the corresponding mount even after mode was toggled to None. Extend the merge patch to REPLACE all three fields at once, sourced from Helm values so user-supplied entries in `controlPlane.apiServer.extra{Args,VolumeMounts,Volumes}` remain intact — only the chart-owned OIDC-only entries drop off. Verified on dev3: with the extended patch, mode=System → mode=None leaves the tenant KCP with `extraArgs: []`, `extraVolumeMounts: []`, and `deployment.extraVolumes` back to just `talos-ca`, `talos-tls-cert` (or those + operator-supplied extras). Signed-off-by: Ivan Okhotnikov --- .../apps/kubernetes/templates/oidc-rbac-job.yaml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml index d87d8f535..91559b91e 100644 --- a/packages/apps/kubernetes/templates/oidc-rbac-job.yaml +++ b/packages/apps/kubernetes/templates/oidc-rbac-job.yaml @@ -180,10 +180,18 @@ spec: # manager takes ownership of spec.deployment.extraVolumes on # write-back to the TenantControlPlane. Verified end-to-end # against a real Kamaji controller. - echo " patching KamajiControlPlane $RELEASE — remove authentication-config volume" + echo " patching KamajiControlPlane $RELEASE — remove OIDC-only entries from extraArgs, extraVolumeMounts, deployment.extraVolumes" + # Patch payload is rendered at helm template time from the same + # source of truth cluster.yaml uses: user-supplied extras stay + # intact, only the chart-owned OIDC-only entries (that Kamaji's + # SSA field-owner refuses to release) are stripped. kubectl --namespace "$RELEASE_NAMESPACE" patch kamajicontrolplane "$RELEASE" \ --type=merge \ - --patch '{"spec":{"deployment":{"extraVolumes":[{"name":"talos-ca","secret":{"secretName":"'"$RELEASE"'-talos-ca"}},{"name":"talos-tls-cert","secret":{"secretName":"'"$RELEASE"'-talos-tls-cert"}}]}}}' + --patch {{ printf "{\"spec\":{\"apiServer\":{\"extraArgs\":%s,\"extraVolumeMounts\":%s},\"deployment\":{\"extraVolumes\":%s}}}" + (default (list) .Values.controlPlane.apiServer.extraArgs | toJson) + (default (list) .Values.controlPlane.apiServer.extraVolumeMounts | toJson) + (concat (list (dict "name" "talos-ca" "secret" (dict "secretName" (printf "%s-talos-ca" .Release.Name))) (dict "name" "talos-tls-cert" "secret" (dict "secretName" (printf "%s-talos-tls-cert" .Release.Name)))) (default (list) .Values.controlPlane.apiServer.extraVolumes) | toJson) + | quote }} # 2. Chart-owned OIDC Secrets — Helm's SSA-based delete-on-absence # also fails here (same field-ownership pattern). Explicit