From 89ad9625f3ec891e5dbfe01d86b6c0560b70eea3 Mon Sep 17 00:00:00 2001 From: Nguyen Minh Phuc Date: Mon, 20 Jul 2026 06:26:13 +0000 Subject: [PATCH] chart: disable externalSecret on this cluster MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The block describes a ClusterSecretStore named `vault` with HashiCorp-style key/property refs. This cluster has `oci-vault` — OCI Vault via InstancePrincipal — whose provider addresses a secret by name and takes a JSON property, so those remoteRefs do not translate as written. There are no ExternalSecrets anywhere on the cluster, so the path had never been exercised. svcforge.secretName still resolves through targetName, so the deployments and the migrate hook read a Secret named svcforge-secrets, created out of band from ~/.config/svcforge/secrets.env. This is a deviation and the comment says so. ArgoCD does not manage that Secret, so prune and selfHeal cannot touch it, and it is the one part of the deployment that cannot be read from git. Restoring the intended design means adding oci_vault_secret resources to oci-k8s/infra/vault.tf and repointing secretStoreRef at oci-vault. --- deploy/chart/values.yaml | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/deploy/chart/values.yaml b/deploy/chart/values.yaml index 332f86a..9b5e140 100644 --- a/deploy/chart/values.yaml +++ b/deploy/chart/values.yaml @@ -81,9 +81,30 @@ otel: log: level: info # The DSNs are pulled from Vault by external-secrets into a Secret the pods envFrom. -# No DSN is ever a chart value, a ConfigMap key, or a CI variable. +# No DSN is ever a chart value, a ConfigMap key, or a CI variable. That invariant holds +# either way here — what changes below is only who creates the Secret. +# +# DISABLED ON THIS CLUSTER, AND THIS IS A DEVIATION, NOT THE DESIGN. +# +# The block below describes a ClusterSecretStore named `vault` with HashiCorp-style +# key/property refs. This cluster has `oci-vault` instead: OCI Vault via InstancePrincipal, +# whose provider addresses a secret by NAME and takes a JSON property, so these remoteRefs +# do not translate as written. There are also no ExternalSecrets anywhere on the cluster +# yet, so nothing has ever exercised this path. +# +# With this false, `svcforge.secretName` still resolves through targetName, so the +# deployments and the migrate hook read a Secret called `svcforge-secrets` that was created +# out of band: +# +# kubectl -n svcforge create secret generic svcforge-secrets \ +# --from-env-file=~/.config/svcforge/secrets.env +# +# ArgoCD does not manage that Secret, so prune and selfHeal cannot touch it — which is also +# why it is invisible in git, and the one part of this deployment you cannot read from the +# repo. Restoring the intended design means adding oci_vault_secret resources to +# oci-k8s/infra/vault.tf and repointing secretStoreRef at oci-vault. externalSecret: - enabled: true + enabled: false secretStoreRef: name: vault kind: ClusterSecretStore