fix(harbor): drive bucket-secret.yaml from values, gate HR on BucketInfo

Two bugs caused the harbor E2E to fail (CI #25049445125):

1. cozy-harbor's bucket-secret.yaml called `index $existingSecret.data
   "BucketInfo"` unconditionally. During first-time install the COSI
   BucketAccess controller may create the credentials Secret as a
   placeholder before populating it, so `.data` is nil and the chart
   render crashes with `index of untyped nil`.

2. The downstream `<release>-system` HelmRelease starts reconciling
   immediately, in parallel with bucket provisioning, hitting bug #1
   on every retry within the test's 5-minute window.

The previous shape relied on `lookup` to read the Secret at render
time. helm-controller's upgrade trigger is digest-based over composed
values + chart artifact, so a `lookup` returning new data on a later
reconcile is not enough on its own to force an upgrade — the rendered
output may diverge but the digest does not.

Switch to a values-driven shape:

- `bucket-secret.yaml` now reads `.Values.bucket.bucketInfo` (a JSON
  string) and uses `dig` for safe access; if the value is empty or the
  expected nested fields are missing, no `*-registry-s3` Secret is
  rendered.
- The `<release>-system` HR sources `BucketInfo` via `valuesFrom` with
  `targetPath: bucket.bucketInfo`. With the default `optional: false`,
  helm-controller will refuse to compose values until the key exists,
  which both gates initial reconciliation on the BucketAccess Secret
  being populated and forces a config-digest change (and thus a helm
  upgrade) when its contents change.
- `bucket.secretName` is removed from the system chart's values and
  from the apps chart's `values:` block; the only consumer (the
  `lookup` call) is gone.

Verified four scenarios via `helm template` against the system chart:
unset bucketInfo, empty string, empty JSON object `{}`, and a
fully-populated BucketInfo — only the last renders the registry-s3
Secret; the others render nothing without erroring.

Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>

packages/apps/harbor/templates/harbor.yaml

@@ -65,9 +65,15 @@ spec:
     name: {{ .Release.Name }}-credentials
     valuesKey: redis-password
     targetPath: harbor.redis.external.password
+  # BucketInfo is populated by the COSI BucketAccess controller. Sourcing it via
+  # valuesFrom both gates reconciliation on the Secret being ready and forces a
+  # config-digest change (and thus a helm upgrade) when its contents change —
+  # Flux HR dependsOn cannot reference COSI resources directly.
+  - kind: Secret
+    name: {{ .Release.Name }}-registry-bucket
+    valuesKey: BucketInfo
+    targetPath: bucket.bucketInfo
   values:
-    bucket:
-      secretName: {{ .Release.Name }}-registry-bucket
     db:
       replicas: {{ .Values.database.replicas }}
       size: {{ .Values.database.size }}

packages/system/harbor/templates/bucket-secret.yaml

@@ -1,10 +1,11 @@
-{{- if .Values.bucket.secretName }}
-{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace .Values.bucket.secretName }}
-{{- $bucketInfo := fromJson (b64dec (index $existingSecret.data "BucketInfo")) }}
-{{- $accessKeyID := index $bucketInfo.spec.secretS3 "accessKeyID" }}
-{{- $accessSecretKey := index $bucketInfo.spec.secretS3 "accessSecretKey" }}
-{{- $endpoint := index $bucketInfo.spec.secretS3 "endpoint" }}
-{{- $bucketName := $bucketInfo.spec.bucketName }}
+{{- if .Values.bucket.bucketInfo }}
+{{- $bucketInfo := fromJson .Values.bucket.bucketInfo }}
+{{- $secretS3 := dig "spec" "secretS3" dict $bucketInfo }}
+{{- if $secretS3 }}
+{{- $accessKeyID := index $secretS3 "accessKeyID" }}
+{{- $accessSecretKey := index $secretS3 "accessSecretKey" }}
+{{- $endpoint := index $secretS3 "endpoint" }}
+{{- $bucketName := dig "spec" "bucketName" "" $bucketInfo }}
 ---
 apiVersion: v1
 kind: Secret
@@ -18,3 +19,4 @@ stringData:
   REGISTRY_STORAGE_S3_BUCKET: {{ $bucketName | quote }}
   REGISTRY_STORAGE_S3_REGION: "us-east-1"
 {{- end }}
+{{- end }}

packages/system/harbor/values.yaml

@@ -1,6 +1,6 @@
 harbor: {}
 bucket:
-  secretName: ""
+  bucketInfo: ""
 db:
   replicas: 2
   size: 5Gi