From 89e2afd5c903b64f13695357992ff97fa135ffb0 Mon Sep 17 00:00:00 2001
From: Chris Butler <chris.butler@redhat.com>
Date: Wed, 2 Sep 2026 08:36:05 +0000
Subject: [PATCH 1/2] Revert "fix: use registry.access.redhat.com for Azure
 workload images (#141)"

This reverts commit 8c2aa7ef8477bd8b5bffafad80cc696013399e31.
---
 values-azure.yaml | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/values-azure.yaml b/values-azure.yaml
index bd1cf310..ca15b9fd 100644
--- a/values-azure.yaml
+++ b/values-azure.yaml
@@ -119,14 +119,6 @@ clusterGroup:
       syncPolicy:
         automated:
           prune: true
-      overrides:
-        # Use the unauthenticated registry.access.redhat.com mirror instead of
-        # registry.redhat.io on Azure -- peer-pods (kata-remote) CVMs pull
-        # images via guest-pull and registry.redhat.io requires credentials
-        # that are non-trivial to thread through that path. Same digest,
-        # same content, just served from a registry that doesn't require auth.
-        - name: image
-          value: "registry.access.redhat.com/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
 
     kbs-access-curl:
       name: kbs-access-curl
@@ -136,10 +128,6 @@ clusterGroup:
       syncPolicy:
         automated:
           prune: true
-      overrides:
-        # See hello-openshift override above for rationale.
-        - name: image
-          value: "registry.access.redhat.com/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
 
     kbs-access-sealed:
       name: kbs-access-sealed
@@ -149,10 +137,6 @@ clusterGroup:
       syncPolicy:
         automated:
           prune: true
-      overrides:
-        # See hello-openshift override above for rationale.
-        - name: image
-          value: "registry.access.redhat.com/ubi9/httpd-24@sha256:68a91ff691092f455fea682330c499588747231c16516cd4f35aff821e6847f2"
 
     kyverno:
       name: kyverno

From cbe03757eed263e7655b6d2dd1dd83fe51a6f298 Mon Sep 17 00:00:00 2001
From: Chris Butler <chris.butler@redhat.com>
Date: Wed, 2 Sep 2026 08:41:45 +0000
Subject: [PATCH 2/2] fix: kbs-access-sealed uses debug-initdata, matching
 kbs-access-curl

kbs-access-curl already mounts the debug-initdata ConfigMap (both the
coco.io/initdata-configmap annotation and the initdata volume). Switch
kbs-access-sealed to the same debug-initdata ConfigMap for consistency
between the two kbs-access test workloads.

Both initdata and debug-initdata are generated by the same
init-data-gzipper.yaml playbook, and the RVPS init_data reference value
already includes both variants' hashes (see rvps-values-policies.yaml's
init_data entry: pcr8Hash, debugPcr8Hash, rawHash, debugRawHash), so this
does not affect attestation.
---
 .../kbs-access-sealed/templates/deployment.yaml               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/charts/coco-supported/kbs-access-sealed/templates/deployment.yaml b/charts/coco-supported/kbs-access-sealed/templates/deployment.yaml
index ce5b3271..ad2503fc 100644
--- a/charts/coco-supported/kbs-access-sealed/templates/deployment.yaml
+++ b/charts/coco-supported/kbs-access-sealed/templates/deployment.yaml
@@ -19,7 +19,7 @@ spec:
       labels:
         app: kbs-access-sealed
       annotations:
-        coco.io/initdata-configmap: initdata
+        coco.io/initdata-configmap: debug-initdata
     spec:
       runtimeClassName: {{ .Values.global.coco.runtimeClassName }}
       containers:
@@ -48,5 +48,5 @@ spec:
           secretName: kbs-sealed-secret
       - name: initdata
         configMap:
-          name: initdata
+          name: debug-initdata
           optional: false