From d9497b849051f561d305aae66a6c4622a20ba1f6 Mon Sep 17 00:00:00 2001
From: gurvinder <gurvsing@redhat.com>
Date: Tue, 6 Oct 2026 13:22:54 -0400
Subject: [PATCH] fix: wire offline SNP VCEK certs into trustee overrides

overrides/values-snp-vcek.yaml (generated by `make snp-gen-overrides`,
which sets kbs.snp.vcekSecrets so the trustee chart mounts each node's
VCEK certificate for offline SNP attestation) was never referenced by
the baremetal clustergroup's trustee application. The KBS SNP verifier
therefore had no VCEK and attestation failed with a 401 ("Failed to
fetch VCEK from any configured source").

- Add overrides/values-snp-vcek.yaml to the trustee application's
  extraValueFiles in values-baremetal.yaml, alongside the existing
  values-trustee.yaml. Helm natively deep-merges both files' kbs.* maps,
  so no custom merge logic is needed.
- Commit overrides/values-snp-vcek.yaml as a placeholder
  (kbs.snp.enabled: true, kbs.snp.vcekSecrets: []) so a fresh checkout
  resolves cleanly.
- scripts/gen-snp-vcek-overrides.sh regenerates this file with a plain
  heredoc overwrite (no awk/parsing needed, since the file is wholly
  owned by the generator and contains nothing hand-written).

Fixes https://github.com/validatedpatterns/coco-pattern/issues/156
---
 overrides/values-snp-vcek.yaml    | 9 +++++++++
 overrides/values-trustee.yaml     | 2 +-
 scripts/gen-snp-vcek-overrides.sh | 5 +++++
 values-baremetal.yaml             | 1 +
 4 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 overrides/values-snp-vcek.yaml

diff --git a/overrides/values-snp-vcek.yaml b/overrides/values-snp-vcek.yaml
new file mode 100644
index 00000000..48507b83
--- /dev/null
+++ b/overrides/values-snp-vcek.yaml
@@ -0,0 +1,9 @@
+# Generated by: make snp-gen-overrides
+#
+# PLACEHOLDER — committed with an empty vcekSecrets list so the trustee app's
+# extraValueFiles reference (values-baremetal.yaml) always resolves on a
+# fresh checkout.
+kbs:
+  snp:
+    enabled: true
+    vcekSecrets: []
diff --git a/overrides/values-trustee.yaml b/overrides/values-trustee.yaml
index 2c110c4e..a8f1459b 100644
--- a/overrides/values-trustee.yaml
+++ b/overrides/values-trustee.yaml
@@ -10,4 +10,4 @@ kbs:
     - name: "kbsres1"
       key: "secret/data/hub/kbsres1"
     - name: "passphrase"
-      key: "secret/data/hub/passphrase"
\ No newline at end of file
+      key: "secret/data/hub/passphrase"
diff --git a/scripts/gen-snp-vcek-overrides.sh b/scripts/gen-snp-vcek-overrides.sh
index b3675d17..3d51af6f 100755
--- a/scripts/gen-snp-vcek-overrides.sh
+++ b/scripts/gen-snp-vcek-overrides.sh
@@ -5,6 +5,11 @@ set -euo pipefail
 # Requires: ~/.coco-pattern/snp-vcek/<hwid>/vcek.der from download step.
 # Output: overrides/values-snp-vcek.yaml (chart values)
 #         stdout: values-secret.yaml entries to add
+#
+# kbs.snp.enabled is set separately in overrides/values-hw-amd-snp.yaml — this
+# script only owns overrides/values-snp-vcek.yaml (kbs.snp.vcekSecrets), which
+# is merged with the rest of the trustee overrides natively by Helm via the
+# trustee application's extraValueFiles list in values-baremetal.yaml.
 
 VCEKDIR="${HOME}/.coco-pattern/snp-vcek"
 OVERRIDE_FILE="overrides/values-snp-vcek.yaml"
diff --git a/values-baremetal.yaml b/values-baremetal.yaml
index f2c5ccf2..4eafaab2 100644
--- a/values-baremetal.yaml
+++ b/values-baremetal.yaml
@@ -197,6 +197,7 @@ clusterGroup:
         argocd.argoproj.io/sync-wave: "20"
       extraValueFiles:
         - '/overrides/values-trustee.yaml'
+        - '/overrides/values-snp-vcek.yaml'
       overrides:
         # Enable attestation-gated secret delivery via KBS
         - name: global.coco.secured