From e79946e79c595d4973f4f0062c9322575e2bbc4a Mon Sep 17 00:00:00 2001
From: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Date: Wed, 4 Nov 2026 10:08:59 +0500
Subject: [PATCH] fix(platform): remove the dead registries value and
 patch-containerd Secret

Nothing reads the Secret: the kubeadm certs.d mount it fed is gone and
the Talos worker config never took it. The value stayed in the Package
spec as a knob that accepts mirrors and does nothing, which is worse
than no knob for an operator in an air-gapped setup. Mirrors for tenant
workers are a per-pool field of the KubernetesNodes chart.

A Package that still sets registries keeps installing: the platform
chart has no values schema, so the key is ignored.

Assisted-By: LLM
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
---
 .../templates/containerd-registry-secret.yaml | 35 -------------------
 packages/core/platform/values.yaml            | 31 ----------------
 2 files changed, 66 deletions(-)
 delete mode 100644 packages/core/platform/templates/containerd-registry-secret.yaml

diff --git a/packages/core/platform/templates/containerd-registry-secret.yaml b/packages/core/platform/templates/containerd-registry-secret.yaml
deleted file mode 100644
index 6e9fb6408..000000000
--- a/packages/core/platform/templates/containerd-registry-secret.yaml
+++ /dev/null
@@ -1,35 +0,0 @@
-{{- if .Values.registries.mirrors }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: patch-containerd
-  namespace: cozy-system
-type: Opaque
-stringData:
-{{- range $registry, $mirror := .Values.registries.mirrors }}
-{{- if $mirror.endpoints }}
-  {{ $registry }}.toml: |
-    server = "https://{{ $registry }}"
-{{- range $endpoint := $mirror.endpoints }}
-    [host."{{ $endpoint }}"]
-      capabilities = ["pull", "resolve"]
-{{- $endpointConfig := index $.Values.registries.config $endpoint }}
-{{- if $endpointConfig }}
-{{- if $endpointConfig.tls }}
-{{- if $endpointConfig.tls.insecureSkipVerify }}
-      skip_verify = true
-{{- end }}
-{{- end }}
-{{- if $endpointConfig.auth }}
-      [host."{{ $endpoint }}".auth]
-        username = "{{ $endpointConfig.auth.username }}"
-        password = "{{ $endpointConfig.auth.password }}"
-{{- end }}
-{{- else }}
-      skip_verify = true
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-{{- end }}
-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index f2ce252ed..23ed9a448 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -768,37 +768,6 @@ scheduling:
 #   loginTheme: acme
 #   loginThemeImage: registry.example.com/acme-keycloak-theme:v1
 branding: {}
-# Container registry mirrors configuration
-#
-# Example:
-# registries:
-#   mirrors:
-#     docker.io:
-#       endpoints:
-#         - http://10.0.0.1:8082
-#     ghcr.io:
-#       endpoints:
-#         - http://10.0.0.1:8083
-#     gcr.io:
-#       endpoints:
-#         - http://10.0.0.1:8084
-#     registry.k8s.io:
-#       endpoints:
-#         - http://10.0.0.1:8085
-#     quay.io:
-#       endpoints:
-#         - http://10.0.0.1:8086
-#     cr.fluentbit.io:
-#       endpoints:
-#         - http://10.0.0.1:8087
-#     docker-registry3.mariadb.com:
-#       endpoints:
-#         - http://10.0.0.1:8088
-#   config:
-#     "10.0.0.1:8082":
-#       tls:
-#         insecureSkipVerify: true
-registries: {}
 # Resource allocation ratios
 resources:
   cpuAllocationRatio: 10