Ray Low 904bc38fc3 fix(kubernetes): delete the Talos PKI and oidc-bootstrap Job on uninstall ...

cert-manager runs with enableCertificateOwnerRef: false, so the
<release>-talos-ca and <release>-talos-tls-cert Secrets carry no
ownerReference to their Certificates and outlive the release, keeping
the CA private key of a cluster that no longer exists. A new cluster
created under the same name then adopts that stale CA instead of
issuing its own trust root.

The <release>-oidc-bootstrap Job is a hook whose only delete policy is
before-hook-creation. Hooks are not part of the release manifest, so
uninstall never removes it.

The pre-delete hook deletes the two Certificates before their Secrets,
because deleting a Secret while its Certificate exists makes
cert-manager re-issue it. It runs after the TenantControlPlane is gone,
since the control plane's CSR signer mounts the CA. The Role grants
each delete by resourceName only.

Assisted-by: LLM
Signed-off-by: Ray Low <crossrt@gmail.com>

2026-10-11 22:40:47 +08:00

..

values

chore(kubernetes): drop remaining nodeGroups residue from docs and fixtures

2026-07-21 22:56:43 +03:00

admin_kubeconfig_wait_test.yaml

fix(kubernetes): drop apex guard on oidc-rbac-job

2026-09-28 15:46:00 +03:00

apiserver_authentication_test.yaml

fix(kubernetes): render the aggregation-layer UID header for tenant OIDC

2026-09-22 18:23:48 +03:00

cilium_gateway_alpn_test.yaml

test(tests): fail absence-only cases when the template renders nothing

2026-10-01 22:27:17 +03:00

cilium_install_retry_test.yaml

fix(kubernetes): retry the tenant CNI install instead of uninstalling it

2026-08-05 13:04:16 +03:00

cilium_kube_proxy_replacement_test.yaml

fix(networking): correct webhook policy assumptions

2026-10-07 05:00:03 +03:00

cluster_autoscaler_args_test.yaml

chore(kubernetes): drop the force-delete flag that blocks partial cleanup

2026-08-18 22:02:56 +03:00

control_plane_only_test.yaml

test(kubernetes): make control-plane-only negative asserts actually check

2026-08-21 00:35:05 +03:00

csi_install_retry_test.yaml

fix(kubernetes): retry the tenant CSI install instead of uninstalling it

2026-08-06 12:43:40 +03:00

csi_rbac_test.yaml

fix(kubernetes): let kubevirt-csi hot-unplug from an orphaned VMI

2026-09-29 12:28:31 +03:00

csi_test.yaml

test(kubernetes): cover LINSTOR StorageClass propagation

2026-06-26 21:20:30 +05:00

csi_vmi_hotplug_fallback_test.yaml

feat(kubevirt)!: drop HotplugVolumes for declarative volume hotplug

2026-09-28 23:37:48 +03:00

dashboard_resourcemap_test.yaml

fix(computeplane): do not grant tenants the cluster admin kubeconfig

2026-10-02 14:36:57 +03:00

delete_hook_test.yaml

fix(kubernetes): delete the Talos PKI and oidc-bootstrap Job on uninstall

2026-10-11 22:40:47 +08:00

gpu_operator_hami_test.yaml

feat(kubernetes): default gpu-operator to an OS-provided driver on Talos

2026-09-29 17:09:13 +02:00

hami_test.yaml

fix(kubernetes): gate HAMi HelmRelease on _namespace.etcd

2026-04-29 11:13:42 +03:00

host_guard_test.yaml

fix(charts): fail fast on empty tenant apex in host composition

2026-09-28 15:14:45 +03:00

ingress_proxied_gate_test.yaml

fix(computeplane): address review round three

2026-07-28 18:08:03 +02:00

kamaji_managed_args_job_test.yaml

fix(kubernetes)!: move or refuse extraArgs flags the control plane owns

2026-09-24 14:59:12 +03:00

kamaji_managed_args_test.yaml

fix(kubernetes)!: move or refuse extraArgs flags the control plane owns

2026-09-24 14:59:12 +03:00

kcsi_sidecar_images_test.yaml

fix(kubernetes): pin KubeVirt CSI sidecars to SIG Storage releases

2026-08-21 15:51:53 +03:00

oidc_test.yaml

chore: drop private cluster, host and personal names from the tree

2026-10-07 04:38:06 +03:00

oidc_withhold_test.yaml

fix(kubernetes): read every extraArgs entry for the OIDC UID flags

2026-09-24 14:58:12 +03:00

ouroboros_test.yaml

feat(ouroboros): bump to v0.7.2 with debug logging on tenants

2026-05-11 02:20:34 +03:00

substrate_proxmox_addons_test.yaml

test(kubernetes): assert where the hypervisor token is and where it is not

2026-09-29 21:04:05 +02:00

substrate_proxmox_gates_test.yaml

test(kubernetes,kubernetes-nodes): assert both sides of every substrate branch

2026-09-25 16:46:15 +02:00

substrate_proxmox_test.yaml

fix(charts): fail fast on empty tenant apex in host composition

2026-09-28 15:14:45 +03:00

substrate_switch_guard_test.yaml

fix(charts): fail fast on empty tenant apex in host composition

2026-09-28 15:14:45 +03:00

talos_k8s_support_matrix_test.yaml

test(kubernetes): update tests for the control-plane-only chart

2026-07-21 22:54:25 +03:00

talos_templates_test.yaml

Merge branch 'main' into feat/kubernetes-nodes-phase2b

2026-08-20 14:04:32 +03:00

values-ci-no-etcd.yaml

chore(kubernetes): drop stale nodeGroups references from fixtures and docs

2026-07-21 22:56:43 +03:00

values-ci.yaml

fix(charts): fail fast on empty tenant apex in host composition

2026-09-28 15:14:45 +03:00

victoria-metrics-operator_test.yaml

fix(kubernetes): gate vmop cert-manager-crds dependency on certManager.enabled

2026-07-03 11:18:46 +05:00

worker_adoption_guard_test.yaml

docs(kubernetes): point references at migration 56 after the renumber

2026-08-21 00:35:05 +03:00