From f12157f889e456cfd55831b17889717342176c50 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 18 Jun 2026 14:53:39 +0200 Subject: [PATCH] fix(deploy): set ProviderConfig secretRef.namespace (required field) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The namespaced github.m.upbound.io ProviderConfig still requires spec.credentials.secretRef.namespace (the CRD enforces it); omitting it made the platform tenant's Flux apply fail dry-run, blocking the whole artifact (ExternalSecret + ProviderConfig + Repository MRs). secretRef.namespace is a value, not the resource namespace, so targetNamespace can't inject it — set it explicitly to github-config where the credential Secret is materialized. Co-Authored-By: Claude Opus 4.8 (1M context) --- deploy/provider-config.yaml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/deploy/provider-config.yaml b/deploy/provider-config.yaml index 3a28cfd..491781a 100644 --- a/deploy/provider-config.yaml +++ b/deploy/provider-config.yaml @@ -2,10 +2,13 @@ # against the devantler-tech org as a GitHub App. Tenant-owned (applied by the # github-config app's ServiceAccount). It is referenced by the namespaced # Repository/… managed resources in this same namespace. The credentials Secret -# is local (same namespace), materialized by external-secret.yaml from OpenBao. -# namespace is omitted on purpose — the platform tenant Kustomization injects it -# via targetNamespace (= github-config). The github.m.upbound.io CRD is installed -# by the provider package (platform infrastructure layer). +# is materialized by external-secret.yaml from OpenBao. +# +# The resource's own namespace is omitted on purpose — the platform tenant +# Kustomization injects it via targetNamespace (= github-config). But +# spec.credentials.secretRef.namespace is a REQUIRED field (the CRD enforces it +# even for a namespaced ProviderConfig) and is a value, not the resource +# namespace, so it must be set explicitly to where the credential Secret lives. apiVersion: github.m.upbound.io/v1beta1 kind: ProviderConfig metadata: @@ -14,5 +17,6 @@ spec: credentials: source: Secret secretRef: + namespace: github-config name: github-app-credentials key: credentials