From 3883d3c02a95359fa28e0ba013122c064dcecc5b Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:31:57 -0700
Subject: [PATCH] fix(helm): map the connector key ring on its own flag;
 staging gets its own ring

The api-keys ExternalSecret only mapped connector-secret-keys /
connector-secret-active-key inside the slack.oauth.enabled block. Staging
runs with Slack OAuth off, so it had no key ring and every hosted-MCP OAuth
callback threw in connectorSecrets (and, unhandled, killed the process).
Gate the ring on slack.oauth.enabled OR connectorSecrets.enabled; staging
sets the latter and reads fresh commonly-staging-* keys (never prod's).
Prod render: unchanged apart from three comment lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V7T2fgquLRaqaYiGLC6Dey
---
 k8s/helm/commonly/templates/secrets/api-keys.yaml | 5 +++++
 k8s/helm/commonly/values-staging.yaml             | 5 +++++
 k8s/helm/commonly/values.yaml                     | 5 +++++
 3 files changed, 15 insertions(+)

diff --git a/k8s/helm/commonly/templates/secrets/api-keys.yaml b/k8s/helm/commonly/templates/secrets/api-keys.yaml
index 1cc841ea91..d21a277fe9 100644
--- a/k8s/helm/commonly/templates/secrets/api-keys.yaml
+++ b/k8s/helm/commonly/templates/secrets/api-keys.yaml
@@ -203,6 +203,11 @@ spec:
   - secretKey: slack-signing-secret
     remoteRef:
       key: {{ $keyPrefix }}slack-signing-secret
+  {{- end }}
+  {{- if or .Values.slack.oauth.enabled .Values.connectorSecrets.enabled }}
+  # Connector secret key ring (keyId:base64,...). Every hosted-MCP and Slack connection is
+  # encrypted with it, so it can't stay tied to Slack OAuth: staging (Slack off) had no ring and
+  # every hosted-MCP callback threw. Both remote keys must exist before enabling.
   - secretKey: connector-secret-keys
     remoteRef:
       key: {{ $keyPrefix }}connector-secret-keys
diff --git a/k8s/helm/commonly/values-staging.yaml b/k8s/helm/commonly/values-staging.yaml
index cc63ce16b1..f78998a139 100644
--- a/k8s/helm/commonly/values-staging.yaml
+++ b/k8s/helm/commonly/values-staging.yaml
@@ -205,3 +205,8 @@ mongodb:
       key: workload-tier
       operator: Equal
       value: spot
+
+# Staging-only connector key ring (commonly-staging-connector-secret-keys / -active-key in SM,
+# fresh keys, never prod's). Without it every hosted-MCP OAuth callback on staging threw.
+connectorSecrets:
+  enabled: true
diff --git a/k8s/helm/commonly/values.yaml b/k8s/helm/commonly/values.yaml
index 52640018e8..c1b0bf62e0 100644
--- a/k8s/helm/commonly/values.yaml
+++ b/k8s/helm/commonly/values.yaml
@@ -57,6 +57,11 @@ slack:
   oauth:
     enabled: false
 
+# Connector secret key ring in api-keys (connector-secret-keys + -active-key). Also mapped
+# whenever slack.oauth.enabled is on. Turn on for any instance that offers hosted-MCP connectors.
+connectorSecrets:
+  enabled: false
+
 # Google Calendar's hosted-MCP entry uses a pre-registered OAuth client
 # (backend/integrations/hostedMcp/googleCalendar.ts). The backend reads
 # GOOGLE_CALENDAR_CLIENT_ID / GOOGLE_CALENDAR_CLIENT_SECRET, the names