From 6d949de7c153f76db4594289c583eb670b8fa1d3 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 10 Apr 2026 00:38:40 +0200
Subject: [PATCH 1/2] fix(kubernetes): merge duplicate files key in
 KubeadmConfigTemplate

The containerd registry certs were added as a separate `files` key
in the KubeadmConfigTemplate spec, which caused a YAML unmarshal
error during post-render: "mapping key 'files' already defined".

Move the containerd certs entries into the existing `files` list
to produce valid YAML.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 .../apps/kubernetes/templates/cluster.yaml    | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 10d6fd80..036e6173 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -217,6 +217,17 @@ spec:
           chmod 0755 /root/kubeadm
           if /root/kubelet --version ; then mv /root/kubelet /usr/bin/kubelet ; fi
           if /root/kubeadm version ; then mv /root/kubeadm /usr/bin/kubeadm ; fi
+      {{- $sec := lookup "v1" "Secret" $.Release.Namespace (printf "%s-patch-containerd" $.Release.Name) }}
+      {{- if $sec }}
+      {{- range $key, $_ := $sec.data }}
+      - path: /etc/containerd/certs.d/{{ trimSuffix ".toml" $key }}/hosts.toml
+        contentFrom:
+          secret:
+            name: {{ $.Release.Name }}-patch-containerd
+            key: {{ $key }}
+        permissions: "0400"
+      {{- end }}
+      {{- end }}
       diskSetup:
         filesystems:
         - device: /dev/vdb
@@ -227,18 +238,6 @@ spec:
       - ["LABEL=ephemeral", "/ephemeral"]
       - ["/ephemeral/kubelet", "/var/lib/kubelet", "none", "bind,nofail"]
       - ["/ephemeral/containerd", "/var/lib/containerd", "none", "bind,nofail"]
-      {{- $sec := lookup "v1" "Secret" $.Release.Namespace (printf "%s-patch-containerd" $.Release.Name) }}
-      {{- if $sec }}
-      files:
-        {{- range $key, $_ := $sec.data }}
-        - path: /etc/containerd/certs.d/{{ trimSuffix ".toml" $key }}/hosts.toml
-          contentFrom:
-            secret:
-              name: {{ $.Release.Name }}-patch-containerd
-              key: {{ $key }}
-          permissions: "0400"
-        {{- end }}
-      {{- end }}
       preKubeadmCommands:
       - KUBELET_VERSION={{ include "kubernetes.versionMap" $}} /usr/bin/update-k8s.sh || true
       - sed -i 's|root:x:|root::|' /etc/passwd

From 5b6dc934d8ba6c3f051488359b16aa243a113d26 Mon Sep 17 00:00:00 2001
From: Andrei Kvapil <kvapss@gmail.com>
Date: Fri, 10 Apr 2026 00:48:22 +0200
Subject: [PATCH 2/2] fix(kubernetes): remove patch-containerd secret lookup

The patch-containerd mechanism copied the secret from cozy-system
into each tenant namespace and then looked it up during template
rendering. This is no longer needed.

Remove the copy-patch-containerd.yaml template and the corresponding
lookup block in cluster.yaml.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
---
 packages/apps/kubernetes/templates/cluster.yaml     | 11 -----------
 .../kubernetes/templates/copy-patch-containerd.yaml | 13 -------------
 2 files changed, 24 deletions(-)
 delete mode 100644 packages/apps/kubernetes/templates/copy-patch-containerd.yaml

diff --git a/packages/apps/kubernetes/templates/cluster.yaml b/packages/apps/kubernetes/templates/cluster.yaml
index 036e6173..8a88b8db 100644
--- a/packages/apps/kubernetes/templates/cluster.yaml
+++ b/packages/apps/kubernetes/templates/cluster.yaml
@@ -217,17 +217,6 @@ spec:
           chmod 0755 /root/kubeadm
           if /root/kubelet --version ; then mv /root/kubelet /usr/bin/kubelet ; fi
           if /root/kubeadm version ; then mv /root/kubeadm /usr/bin/kubeadm ; fi
-      {{- $sec := lookup "v1" "Secret" $.Release.Namespace (printf "%s-patch-containerd" $.Release.Name) }}
-      {{- if $sec }}
-      {{- range $key, $_ := $sec.data }}
-      - path: /etc/containerd/certs.d/{{ trimSuffix ".toml" $key }}/hosts.toml
-        contentFrom:
-          secret:
-            name: {{ $.Release.Name }}-patch-containerd
-            key: {{ $key }}
-        permissions: "0400"
-      {{- end }}
-      {{- end }}
       diskSetup:
         filesystems:
         - device: /dev/vdb
diff --git a/packages/apps/kubernetes/templates/copy-patch-containerd.yaml b/packages/apps/kubernetes/templates/copy-patch-containerd.yaml
deleted file mode 100644
index 43345276..00000000
--- a/packages/apps/kubernetes/templates/copy-patch-containerd.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- $sourceSecret := lookup "v1" "Secret" "cozy-system" "patch-containerd" }}
-{{- if $sourceSecret }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ .Release.Name }}-patch-containerd
-  namespace: {{ .Release.Namespace }}
-type: {{ $sourceSecret.type }}
-data:
-{{- range $key, $value := $sourceSecret.data }}
-  {{ printf "%s: %s" $key ($value | quote) | indent 2 }}
-{{- end }}
-{{- end }}