Surfaced on t22.omantel.biz 2026-05-18: self-sovereign-cutover step
06 succeeds but step 08 fails with exactly one OFFENDER —
`flux-system/openova-catalog=oci://ghcr.io/openova-io`. Step 06's
phase-1 lives K8s patch and phase-2 Gitea YAML edit both miss
`openova-catalog` because:
1. `openova-catalog` is not in `helmRepositories.names` (the loop
only iterated 38 bp-* names).
2. `openova-catalog` is rendered by the bp-catalyst-platform Helm
chart (`products/catalyst/chart/templates/openova-catalog-
helmrepository.yaml`) from `.Values.catalog.helmRepository.url`,
NOT directly from a `clusters/_template/bootstrap-kit/*.yaml`
slot file. Phase-2's sed only rewrites slot files.
Result: even if phase-1 patched the live HR (it didn't — name not in
list), helm-controller's next reconcile (every 15m, plus the
post-cutover reconcile trigger) re-renders `openova-catalog` HR
from the chart's default `oci://ghcr.io/openova-io`. Step 08 catches
the regression and fails the sovereignty proof.
Fix (3 surgical edits, no new abstractions):
- chart/values.yaml: add `openova-catalog` to
`helmRepositories.names` so step 06 phase-1 patches it.
- chart/templates/06-helmrepository-patches-job.yaml: new
Phase-1.6 patches the parent bp-catalyst-platform HelmRelease's
`spec.values.catalog.helmRepository.url` so the next chart
reconcile preserves the local URL (durable across helm-controller
reconciles). New Phase-2.5 injects (or rewrites in-place) the
same override into 13-bp-catalyst-platform.yaml in the local
Gitea repo so bootstrap-kit Kustomization reconcile doesn't
revert the HelmRelease. Both phases are idempotent.
- clusters/_template/bootstrap-kit/06a-bp-self-sovereign-cutover.yaml:
chart pin 0.1.30 -> 0.1.31.
- chart/Chart.yaml: version 0.1.30 -> 0.1.31 with changelog comment.
Validated:
- `helm template platform/self-sovereign-cutover/chart` renders
cleanly with `openova-catalog` in the rendered names list.
- `bash -n` on the extracted step 06 script is clean.
Co-authored-by: hatiyildiz <hatice.yildiz@openova.io>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4ba8e80788