From 4d98b20cad83b5f248610e6355be6069da3aa741 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 08:19:17 +0000
Subject: [PATCH 1/2] Initial plan


From ef96b7c457f8c52af510c1a07fb8f66f20c09400 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 30 May 2026 08:23:07 +0000
Subject: [PATCH 2/2] feat(chart): make credential migration job configurable

---
 charts/opencloud/README.md                    |  2 ++
 .../templates/opencloud/migration-job.yaml    |  2 +-
 .../opencloud/tests/migration-job_test.yaml   | 22 +++++++++++++++++++
 charts/opencloud/values.yaml                  |  2 ++
 4 files changed, 27 insertions(+), 1 deletion(-)
 create mode 100644 charts/opencloud/tests/migration-job_test.yaml

diff --git a/charts/opencloud/README.md b/charts/opencloud/README.md
index 6133878..3b659df 100644
--- a/charts/opencloud/README.md
+++ b/charts/opencloud/README.md
@@ -389,6 +389,7 @@ The job and its RBAC resources (ServiceAccount, Role, RoleBinding) are cleaned u
 
 | Parameter | Description | Default |
 | --------- | ----------- | ------- |
+| `opencloud.migration.enabled` | Enable the credential migration job hook | `true` |
 | `opencloud.migration.configPvcClaimName` | Name of the legacy config PVC to read credentials from | `<release>-opencloud-config` |
 
 **Example:**
@@ -396,6 +397,7 @@ The job and its RBAC resources (ServiceAccount, Role, RoleBinding) are cleaned u
 ```yaml
 opencloud:
   migration:
+    enabled: true
     configPvcClaimName: "my-old-opencloud-config"
 ```
 
diff --git a/charts/opencloud/templates/opencloud/migration-job.yaml b/charts/opencloud/templates/opencloud/migration-job.yaml
index 1eb50db..1624f8d 100644
--- a/charts/opencloud/templates/opencloud/migration-job.yaml
+++ b/charts/opencloud/templates/opencloud/migration-job.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.opencloud.enabled }}
+{{- if and .Values.opencloud.enabled .Values.opencloud.migration.enabled }}
 {{- $jobName := printf "%s-credential-migration" (include "opencloud.opencloud.fullname" .) -}}
 {{- $saName := printf "%s-credential-migration" (include "opencloud.opencloud.fullname" .) -}}
 {{- $targetSecret := .Values.opencloud.initSecrets.existingSecret | default (printf "%s-init" (include "opencloud.opencloud.fullname" .)) -}}
diff --git a/charts/opencloud/tests/migration-job_test.yaml b/charts/opencloud/tests/migration-job_test.yaml
new file mode 100644
index 0000000..0e19b6d
--- /dev/null
+++ b/charts/opencloud/tests/migration-job_test.yaml
@@ -0,0 +1,22 @@
+suite: Credential Migration Job Tests
+
+templates:
+  - _helpers/tpl.yaml
+  - opencloud/migration-job.yaml
+
+tests:
+  - it: migration job resources are created by default
+    template: opencloud/migration-job.yaml
+    asserts:
+      - hasDocuments:
+          count: 4
+
+  - it: migration job resources are not created when disabled
+    template: opencloud/migration-job.yaml
+    set:
+      opencloud:
+        migration:
+          enabled: false
+    asserts:
+      - hasDocuments:
+          count: 0
diff --git a/charts/opencloud/values.yaml b/charts/opencloud/values.yaml
index dec3ce0..4bf2a11 100644
--- a/charts/opencloud/values.yaml
+++ b/charts/opencloud/values.yaml
@@ -498,6 +498,8 @@ opencloud:
       accessMode: ReadWriteOnce
   # Migration configuration for migrating credentials from legacy config PVC to new secrets
   migration:
+    # Enable credential migration job on chart upgrades.
+    enabled: true
     # Name of the legacy config PVC to read credentials from.
     # Defaults to "<fullname>-config" if not set.
     configPvcClaimName: ""