kamaji package: the vendored kamaji-etcd values block is dead today and would deploy an etcd silently if the subchart is ever vendored #4397

The kamaji-etcd values block in packages/system/kamaji configures a subchart that is not there, and it would start configuring a real one the day make update brings it in.

The vendored charts/kamaji/Chart.yaml declares a kamaji-etcd dependency and ships a Chart.lock for it, but the subchart itself is not vendored under charts/kamaji/charts/. Helm runs CheckDependencies only for the chart it was asked to render, and that is the package's own top-level chart, whose Chart.yaml declares no dependencies at all. So the missing subchart is never noticed, the whole kamaji-etcd.* block in the vendored values is dead configuration, and the cert-manager keys the recent upstream versions added to it are dead with it.

That is fine today and it is why removing the kamaji.etcd.deploy key from the package values was right: that key named a path nothing reads, and the real condition is kamaji-etcd.deploy, which defaults to true. The hazard is the combination. If a later make update pulls the subchart into charts/kamaji/charts/, the block stops being dead, the default takes effect, and an etcd deploys without anyone having asked for one. Nothing in the package would report the change, because the values file already contains the settings that would drive it.

Two ways to close it, and they are not equivalent: pin kamaji-etcd.deploy: false in the package values so the default cannot fire, or drop the block entirely so a future vendoring has to re-add it deliberately. The first keeps the configuration honest about what it disables; the second removes the trap rather than disarming it.

Found while reviewing the bump to 26.9.4-edge, which changes neither the dependency nor the vendoring.