From 506f4956a50e53b1bbca359cdcf21136efa22bb6 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 11:48:45 +0000 Subject: [PATCH 1/3] chore: remove redundant overrides from clusterGroup values - Remove `source: redhat-operators` (upstream default) from 8 subscriptions - Remove `installPlanApproval: Automatic` (upstream default) from lvm-operator, cnv - Remove `#upstream config` comments from namespace fields - Add missing `project: sandbox` to sandbox-policies in 3 files - Fix trailing whitespace on `installPlanApproval: Manual` Co-Authored-By: Claude Opus 4.6 (1M context) --- values-azure-spoke.yaml | 5 ++--- values-azure.yaml | 11 +++++------ values-baremetal.yaml | 7 +------ values-trusted-hub.yaml | 6 +++--- 4 files changed, 11 insertions(+), 18 deletions(-) diff --git a/values-azure-spoke.yaml b/values-azure-spoke.yaml index 9e724888..43cd34d9 100644 --- a/values-azure-spoke.yaml +++ b/values-azure-spoke.yaml @@ -24,9 +24,8 @@ clusterGroup: sandbox: name: sandboxed-containers-operator namespace: openshift-sandboxed-containers-operator - source: redhat-operators channel: stable - installPlanApproval: Manual + installPlanApproval: Manual csv: sandboxed-containers-operator.v1.12.0 cert-manager: name: openshift-cert-manager-operator @@ -57,7 +56,7 @@ clusterGroup: sandbox: name: sandbox - namespace: openshift-sandboxed-containers-operator #upstream config + namespace: openshift-sandboxed-containers-operator project: sandbox chart: sandboxed-containers chartVersion: 0.2.* diff --git a/values-azure.yaml b/values-azure.yaml index 69848dec..48c5d703 100644 --- a/values-azure.yaml +++ b/values-azure.yaml @@ -34,14 +34,12 @@ clusterGroup: sandbox: name: sandboxed-containers-operator namespace: openshift-sandboxed-containers-operator - source: redhat-operators channel: stable - installPlanApproval: Manual + installPlanApproval: Manual csv: sandboxed-containers-operator.v1.12.0 trustee: name: trustee-operator namespace: trustee-operator-system - source: redhat-operators channel: stable installPlanApproval: Manual csv: trustee-operator.v1.1.0 @@ -86,7 +84,7 @@ clusterGroup: chartVersion: 0.0.* trustee: name: trustee - namespace: trustee-operator-system #upstream config + namespace: trustee-operator-system project: trustee chart: trustee chartVersion: 0.8.* @@ -97,13 +95,14 @@ clusterGroup: value: "true" sandbox: name: sandbox - namespace: openshift-sandboxed-containers-operator #upstream config + namespace: openshift-sandboxed-containers-operator project: sandbox chart: sandboxed-containers chartVersion: 0.2.* sandbox-policies: name: sandbox-policies - namespace: openshift-sandboxed-containers-operator #upstream config + namespace: openshift-sandboxed-containers-operator + project: sandbox chart: sandboxed-policies chartVersion: 0.2.* overrides: diff --git a/values-baremetal.yaml b/values-baremetal.yaml index 4ddb685e..62f6ae71 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -39,7 +39,6 @@ clusterGroup: sandbox: name: sandboxed-containers-operator namespace: openshift-sandboxed-containers-operator - source: redhat-operators channel: stable installPlanApproval: Manual csv: sandboxed-containers-operator.v1.12.0 @@ -48,7 +47,6 @@ clusterGroup: trustee: name: trustee-operator namespace: trustee-operator-system - source: redhat-operators channel: stable installPlanApproval: Manual csv: trustee-operator.v1.1.0 @@ -61,14 +59,10 @@ clusterGroup: lvm-operator: name: lvms-operator namespace: openshift-storage - source: redhat-operators - installPlanApproval: Automatic cnv: name: kubevirt-hyperconverged namespace: openshift-cnv - source: redhat-operators channel: stable - installPlanApproval: Automatic nfd: name: nfd namespace: openshift-nfd @@ -261,6 +255,7 @@ clusterGroup: sandbox-policies: name: sandbox-policies namespace: openshift-sandboxed-containers-operator + project: sandbox chart: sandboxed-policies chartVersion: 0.2.* annotations: diff --git a/values-trusted-hub.yaml b/values-trusted-hub.yaml index fbf6bdf1..a54f1a48 100644 --- a/values-trusted-hub.yaml +++ b/values-trusted-hub.yaml @@ -29,7 +29,6 @@ clusterGroup: trustee: name: trustee-operator namespace: trustee-operator-system - source: redhat-operators channel: stable installPlanApproval: Manual csv: trustee-operator.v1.1.0 @@ -75,7 +74,7 @@ clusterGroup: trustee: name: trustee - namespace: trustee-operator-system #upstream config + namespace: trustee-operator-system project: trustee chart: trustee chartVersion: 0.8.* @@ -86,7 +85,8 @@ clusterGroup: value: "true" sandbox-policies: name: sandbox-policies - namespace: openshift-sandboxed-containers-operator #upstream config + namespace: openshift-sandboxed-containers-operator + project: sandbox chart: sandboxed-policies chartVersion: 0.2.* overrides: From 05e59d1e62e2b95541f999992ff7bb4d506481ad Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 11:53:56 +0000 Subject: [PATCH 2/3] chore(baremetal): remove dead secretStore overrides from sandbox app MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sandboxed-containers chart only uses secretStore.name/kind in ssh-key-eso.yaml, which is triple-gated on enableSSHDebug AND backend != none AND clusterPlatform == Azure. On baremetal, this template never renders, making these overrides dead code. global.secretStore.backend is also redundant — already set in values-global.yaml and propagated via clustergroup helm parameters. Co-Authored-By: Claude Opus 4.6 (1M context) --- values-baremetal.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/values-baremetal.yaml b/values-baremetal.yaml index 62f6ae71..b7fbaa83 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -204,12 +204,6 @@ clusterGroup: chart: sandboxed-containers chartVersion: 0.2.* overrides: - - name: global.secretStore.backend - value: vault - - name: secretStore.name - value: vault-backend - - name: secretStore.kind - value: ClusterSecretStore - name: enablePeerPods value: "false" From e9394570c9394fd3f4c26413bf7caf49fb1f3578 Mon Sep 17 00:00:00 2001 From: Chris Butler Date: Thu, 16 Jul 2026 12:00:29 +0000 Subject: [PATCH 3/3] chore(intel-dcap): set secretStore defaults, remove inline overrides Set chart defaults to vault-backend/ClusterSecretStore instead of empty strings. Child apps receive the global secretStore via values-global.yaml (included in every app's valueFiles by the clustergroup chart), so inline overrides in the topology file are redundant. Co-Authored-By: Claude Opus 4.6 (1M context) --- charts/all/intel-dcap/values.yaml | 4 ++-- values-baremetal.yaml | 5 ----- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/charts/all/intel-dcap/values.yaml b/charts/all/intel-dcap/values.yaml index 5910caed..049a9993 100644 --- a/charts/all/intel-dcap/values.yaml +++ b/charts/all/intel-dcap/values.yaml @@ -3,5 +3,5 @@ baremetal: nodeSelector: "" # optional: hostname for PCCS pinning. Empty = schedule anywhere with tolerations. secretStore: - name: "" - kind: "" + name: vault-backend + kind: ClusterSecretStore diff --git a/values-baremetal.yaml b/values-baremetal.yaml index b7fbaa83..0d037ace 100644 --- a/values-baremetal.yaml +++ b/values-baremetal.yaml @@ -221,11 +221,6 @@ clusterGroup: name: sgxdeviceplugin-sample jsonPointers: - /spec - overrides: - - name: secretStore.name - value: vault-backend - - name: secretStore.kind - value: ClusterSecretStore nvidia-gpu: name: nvidia-gpu