Repository navigation
fix(helm): collector guard migrations for KMS alias, partitions and reuse-values - #68
Merged
tim-thacker-nullify merged 3 commits intoSep 15, 2026
Conversation
… errors - An alias keyArn still fails, now saying to use the key ARN from the Nullify configure page and to contact Nullify if the page shows an alias. - The region mismatch error explains that --reuse-values from 0.2.0 carries us-east-1, and to upgrade with --reset-then-reuse-values or set the region. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…lector role-arn guard - The EKS role-arn guard accepts arn:aws, arn:aws-us-gov and arn:aws-cn. - serviceAccount.requireRoleArn (default true) lets EKS Pod Identity, instance-profile and kube2iam/kiam installs render without IRSA; an empty role-arn annotation is no longer rendered. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…values upgrades Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Member
Author
This was referenced Sep 14, 2026
Closed
Member
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#63's guards give no way forward for an alias key ARN, non-IRSA credentials, GovCloud or China role ARNs, or a
--reuse-valuesupgrade from 0.2.0. Stacked on #63.Do not release #63 or this PR until monorepo PR #12787 is deployed. The configure page shows the customer-uploads KMS alias today, which this chart rejects. #12787 makes admin serve the key ARN.
Merge order: this into #63; #60 (with #65) before #58, #59 and #63. A separate connector PR makes Terraform
kms_key_arnvalidation reject aliases too.collector.kms.keyArnstill fails, because the IAMResourceneeds the key ARN and alias installs were already deniedkms:GenerateDataKey.arn:aws,arn:aws-us-govandarn:aws-cn.serviceAccount.requireRoleArn(defaulttrue). Setfalsefor EKS Pod Identity, instance profiles, or kube2iam/kiam.--reuse-valuesfrom 0.2.0 carriesus-east-1. Use--reset-then-reuse-values(Helm 3.14+) or setcollector.aws.region.reuse-values-from-0.2.0.yaml(0.2.0 defaults plus anap-southeast-2key);kms-alias.yamlnow expects the migration text;ci/eks-no-irsa.yamlandci/eks-govcloud-role.yaml.#63's body is also corrected. The old workflow's lint never gated its release (F60-1 is the real hazard). The namespace hook did succeed on an absent namespace; the Job's unpullable
bitnami/kubectl:latestandexit 0were the defect.Nothing rendered locally. #58's workflow has no
pull_requesttrigger, so this branch's CI runs on a throwaway draft that merges it onto #65 (linked in a comment).🤖 Generated with Claude Code