* fix(bp-external-secrets): split ClusterSecretStore into bp-external-secrets-stores chart (resolves CRD ordering, closes#331)
bp-external-secrets@1.0.0 deadlocked on first install on otech.omani.works:
Helm install failed for release external-secrets-system/external-secrets
with chart bp-external-secrets@1.0.0:
failed post-install: unable to build kubernetes object for deleting hook
bp-external-secrets/templates/clustersecretstore-vault-region1.yaml:
resource mapping not found for name: "vault-region1" namespace: ""
no matches for kind "ClusterSecretStore" in version "external-secrets.io/v1beta1"
Root cause: Helm's `helm.sh/hook-delete-policy: before-hook-creation` ran
a kubectl-style lookup of the existing ClusterSecretStore CR before the
upstream `external-secrets` subchart's CRDs finished registration. The
in-line ClusterSecretStore template (templates/clustersecretstore-vault-
region1.yaml) and the upstream subchart's CRDs co-installed in the same
release; admission ordering wasn't deterministic enough to make the
post-install hook safe.
Fix — same pattern as PR #247 (bp-crossplane@1.1.3 ↔ bp-crossplane-claims@1.0.0):
split the chart into controller + stores. Flux dependsOn orders them.
- bp-external-secrets@1.1.0 — controller-only (just upstream subchart
+ NetworkPolicy + ServiceMonitor toggle). CRDs register here.
- bp-external-secrets-stores@1.0.0 (NEW) — the default
ClusterSecretStore CR; depends on bp-external-secrets being Ready.
No Helm hooks needed: by the time this chart's HelmRelease starts,
Flux has already verified bp-external-secrets is Ready=True and
therefore the CRDs are registered.
Files:
NEW: platform/external-secrets-stores/blueprint.yaml (1.0.0)
NEW: platform/external-secrets-stores/chart/Chart.yaml (1.0.0; no upstream subchart, annotation `catalyst.openova.io/no-upstream: "true"`)
NEW: platform/external-secrets-stores/chart/values.yaml (clusterSecretStore.* knobs moved from controller chart)
MOVED: platform/external-secrets/chart/templates/clustersecretstore-vault-region1.yaml
→ platform/external-secrets-stores/chart/templates/clustersecretstore-vault-region1.yaml
(Helm hook annotations removed — Flux dependsOn now handles ordering)
TOUCHED: platform/external-secrets/chart/Chart.yaml (1.0.0 → 1.1.0; description note appended)
TOUCHED: platform/external-secrets/blueprint.yaml (1.0.0 → 1.1.0)
TOUCHED: platform/external-secrets/chart/values.yaml (clusterSecretStore block removed; pointer comment added)
NEW: clusters/_template/bootstrap-kit/15a-external-secrets-stores.yaml
(Flux HelmRelease, dependsOn: [bp-external-secrets, bp-openbao])
TOUCHED: clusters/_template/bootstrap-kit/15-external-secrets.yaml
(chart version 1.0.0 → 1.1.0)
TOUCHED: clusters/_template/bootstrap-kit/kustomization.yaml
(slot 15a inserted after 15)
Out of scope for this PR (separate tickets):
- blueprint-release.yaml CI fan-out: verify the path-matrix picks up
the new platform/external-secrets-stores/ directory automatically;
if not, add the directory to the matrix in a follow-up.
- Per-Sovereign cluster directory edits (#257 will delete those).
- Phase 0 minimum trim (#310 will renumber slots; this PR uses 15a as
a non-disruptive sub-slot insertion that works with both the current
35-slot kustomization and the eventual 15-slot canonical layout —
when #310 renumbers, 15 + 15a become 08 + 09 in the canonical order).
Refs: #331 (this issue), #247 (pattern reference — bp-crossplane split),
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(scripts): register bp-external-secrets-stores in expected-bootstrap-deps.yaml
The dependency-graph-audit CI step rejected PR #334 because the new
bp-external-secrets-stores HR was on disk at slot 15a but missing from
the expected DAG. This commit adds it with the same dependsOn shape as
clusters/_template/bootstrap-kit/15a-external-secrets-stores.yaml:
[bp-external-secrets, bp-openbao].
Refs: #331, #310 (Phase 0 minimum), PR #334.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(bp-external-secrets): retire CR cases from controller test, add stores-toggle (#331)
After splitting the default ClusterSecretStore into bp-external-secrets-stores
@1.0.0, the controller chart's observability-toggle integration test still
expected the CR to render in the controller chart (Cases 4 + 5). Those
assertions now belong on the new chart.
Changes:
- platform/external-secrets/chart/tests/observability-toggle.sh:
Replace Cases 4+5 with a single inverted assertion — the controller
chart MUST render ZERO ClusterSecretStore CRs (top-level kind:); only
the upstream subchart's CRD definition (whose spec.names.kind value is
"ClusterSecretStore" at non-zero indent) is allowed.
- platform/external-secrets-stores/chart/tests/clustersecretstore-toggle.sh:
NEW. Mirrors the retired Cases 4+5 against the stores chart, plus a
Case 3 that asserts clusterSecretStore.server overrides propagate.
Local smoke:
bash platform/external-secrets/chart/tests/observability-toggle.sh → 4/4 PASS
bash platform/external-secrets-stores/chart/tests/clustersecretstore-toggle.sh → 3/3 PASS
Refs: #331, PR #334.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(scripts): handle alphanumeric sub-slot suffixes in check-bootstrap-deps.sh
PR #334 (issue #331) added slot 15a-external-secrets-stores as a sub-slot
between numeric slots 15 and 16. The bootstrap-deps audit script's
`printf '%02d'` formatter rejected `15a` with:
scripts/check-bootstrap-deps.sh: line 390: printf: 15a: invalid number
Fix: detect non-numeric slot tokens and pass them through verbatim. Numeric
slots still render as zero-padded `01..49` for output alignment.
Local smoke:
$ bash scripts/check-bootstrap-deps.sh
...
[P] slot 15 bp-external-secrets <-- bp-cert-manager bp-openbao
[P] slot 15a bp-external-secrets-stores <-- bp-external-secrets bp-openbao
...
OK: bootstrap-kit dependency graph audit PASSED
Refs: #331, PR #334.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* docs(wbs): tick #331 chart-released
bp-external-secrets@1.1.0 (controller-only) + bp-external-secrets-stores@1.0.0
(NEW) shipped in PR #426. Helm-template acceptance + both toggle tests +
dependency-graph-audit all green. Sovereign-impact deferred to Phase 8.
Refs: #331, PR #426.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Hatice Yildiz <hatice.yildiz@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: hatiyildiz <hatiyildiz@noreply.github.com>
92b7db622d