Declare the webhook's AWS Secrets Manager account and region

[ctxswitch]

Overview

The webhook's secret injector reads its config from config.core.webhook.embeddedSecretManagerConfig, which had no awsConfig. There was no supported way to point it at an AWS Secrets Manager outside the cluster's own account.

This declares awsConfig.account and awsConfig.region there, passed through to the webhook by the existing propeller.webhookConfigMinimal helper — no template change needed, it already emits the whole config.core.webhook subtree.

      embeddedSecretManagerConfig:
        type: "{{ .Values.proxy.secretManager.type }}"
        awsConfig:
          account: ""
          region: ""

Three decisions worth reviewing

Empty defaults, not values derived from the cluster. account: "" takes the existing bare-name path, and region: "" leaves WithRegion(""), which is a no-op in the SDK. So this is inert everywhere until an operator sets it.

Deliberately not defaulted from global.AWS_ACCOUNT_ID / global.AWS_REGION. Those are the cluster's own identity; this is the secret store's. They coincide today on every deployment, but they are different facts — defaulting from the globals would address every existing cluster's secrets by ARN at once, which is exactly the behaviour change this must avoid.

Base values.yaml, not values.aws.yaml. The selfmanaged ArgoCD ApplicationSet (appset-selfmanaged-dataplane.yaml in unionai/cloud) supplies only the per-environment values files from that repo and never references the chart's provider overlays. A key declared in values.aws.yaml would never reach a selfmanaged environment.

This is also distinct from config.proxy.smConfig.awsConfig, which identifies the backend for the operator's drift reporting and is unrelated to what the webhook connects to.

Test Plan

make generate-expected then make helm-test — exit 0.

The snapshot diff across all 32 dataplane files is exactly the three added lines plus the config checksums they necessarily move:

+ account: ""
+ awsConfig:
+ region: ""

Rendered against a Fleet-produced values file that sets the key, the deep-merge is intact — account and region land in the leaseworker ConfigMap's webhook.yaml alongside the chart's own clusterName, imagePullSecrets and k8sConfig:

      embeddedSecretManagerConfig:
        awsConfig:
          account: "123456789012"
          region: us-east-2
        clusterName: 'production'
        imagePullSecrets:
          enabled: true
        k8sConfig:
          namespace: 'union'

Rollout

No behaviour change on any existing deployment — both fields default to empty, which is what the webhook does today.

Cross-account reads need more than this key. The store's account also requires a resource policy on each secret, a customer-managed KMS key granting the webhook's role kms:Decrypt (the AWS-managed aws/secretsmanager key cannot be shared across accounts), and secretsmanager:GetSecretValue on the ARN in that role's identity policy. RELEASE.md records this.

Requires the corresponding unionai/flyte change (unionai/flyte#1010) to be in the image for the key to do anything. Landing this first is safe — the webhook's config accessor is not in strict mode, so an unknown key on an older image is ignored.

Related: unionai/cloud emits this from the Fleet AWS templates in a separate PR.

Issue

ref ENG26-1262

🤖 Generated with Claude Code

https://claude.ai/code/session_01YM4D6dtkWFVUh33vt4UA3J

[aviator-app]

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This pull request is currently open (not queued).

How to merge

To merge this PR, comment /aviator merge or add the mergequeue label.

---

See the real-time status of this PR on the Aviator webapp.

Use the Aviator Chrome Extension to see the status of your PR within GitHub.