Remove HVS Support

[vijayavelsekar]

Description

HCP Vault Secrets (HVS) reached end-of-life on July 1, 2026. This PR removes all
HVS integration from the Vault Secrets Operator (VSO) now that the service is shut down.

The two Custom Resource Definitions introduced for HVS — HCPAuth and
HCPVaultSecretsApp — their controllers, API types, credentials provider,
RBAC manifests, Helm chart assets, CRD manifests, sample configs, integration tests,
and the github.com/hashicorp/hcp-sdk-go Go module dependency have all been
permanently deleted from the codebase.

---

What was removed

Category	Detail
API types	HCPAuth, HCPVaultSecretsApp (and all generated deep-copy functions)
Controllers	HCPAuthReconciler, HCPVaultSecretsAppReconciler
Credentials provider	credentials/hcp package (provider.go, service_principal.go)
CRD manifests	secrets.hashicorp.com_hcpauths.yaml, secrets.hashicorp.com_hcpvaultsecretsapps.yaml (config + Helm chart)
RBAC manifests	hcpauth-editor/viewer-role, hcpsecretsapp-editor/viewer-role (config + Helm chart)
Helpers	WithHVSAppSecrets, MakeHVSShadowSecretData, FromHVSShadowSecret, HVSSecretType* constants
Tests	Controller unit tests + integration test terraform for HCPVaultSecretsApp (test/integration/hcpvaultsecretsapp/)
Go dependency	github.com/hashicorp/hcp-sdk-go v0.118.0 and its transitive modules (go mod tidy)
Kustomize overlays	config/hvsa-tests/ overlay; stale HCP resource entries in config/crd/kustomization.yaml
OLM CSV	HCPAuth + HCPVaultSecretsApp entries removed from customresourcedefinitions.owned
main.go flag	-min-refresh-after-hvsa flag and reconciler setup blocks removed
CI action inputs	hcp-organization-id, hcp-project-id, hcp-client-id, hcp-client-secret inputs removed from .github/actions/integration-test/action.yml and both call sites in .github/workflows/build.yaml (was causing all enterprise=true CI jobs to fail on fork PRs)
Makefile variables	SKIP_HCPVSAPPS_TESTS removed from Makefile, scale-testing.mk, and gcp.mk
PROJECT resource entries	HCPAuth and HCPVaultSecretsApp kubebuilder resource entries removed
controllers/registry.go	HCPVaultSecretsApp ResourceKind constant and its String() case removed
Demo Terraform	demo/infra/app/hcpvs.tf deleted; 6 HCP variables (with_hcp_vault_secrets, hcp_organization_id, hcp_project_id, hcp_client_id, hcp_client_secret, hcp_hvs_app_name) removed from demo/infra/app/variables.tf
Diagram	docs/diags/hcp-secrets.puml deleted; unused AddElementTag("hvs", ...) removed from docs/diags/csi-trusted-orchestrator.puml
Stale comment	docs/diags/secrets-transformation.puml — , HCPVS removed from secret source description
Stale doc comment	credentials/credentials.go — HCPAuth removed from New() doc comment
Dead constants	consts/reasons.go — ReasonHVSClientConfigError and ReasonHVSSecret removed (unreferenced)

---

What was added / fixed

Category	Detail
Chart upgrade test	Fixed TestChart_upgradeCRDs in test/chart/chart_test.go to handle CRDs removed from the chart. Helm never deletes CRDs during upgrade, so hcpauths and hcpvaultsecretsapps remain as orphans in the cluster after upgrading from any old chart version. The previous assertion (expected: 8, actual: 10) assumed the chart only ever grows. The fix counts only CRDs declared by the new chart and separately validates that any extra cluster CRDs are traceable to the old install.
Bats unit tests	Fixed clusterRoleAggregatedViewer: subset and clusterRoleAggregatedEditor: subset in test/unit/clusterrole-aggregates.bats — replaced HCPAuth example value with vaultStaticSecret so the subset selection tests no longer reference a removed role.
utils/utils_test.go	Replaced HCPAuth CRD fixture with a neutral TestCRD name in TestUpgradeCRDs — the test validates the CRD upgrade utility, not HCPAuth itself.

---

⚠️ Upgrade action required (clusters with existing HVS resources)

Clusters that have HCPVaultSecretsApp or HCPAuth instances must clean up
those resources before upgrading to this version of VSO. The critical risk is that
every HCPVaultSecretsApp instance carries the finalizer
hcpvaultsecretsapp.secrets.hashicorp.com/finalizer; if the old operator is removed
before the instances are deleted, Kubernetes will hold them in Terminating
indefinitely.

HVS Cleanup Steps — Quick Reference

Path A — Before Upgrade (Recommended)

Step	Summary
1 — Inventory	List all HCPVaultSecretsApp and HCPAuth instances across all namespaces
2 — Delete HCPVaultSecretsApps	Delete all instances cluster-wide and wait for full termination before continuing
3 — Delete HCPAuths	Delete all HCPAuth instances cluster-wide (no finalizer, completes instantly)
4 — Verify shadow secrets	Confirm no vso-hvs-* secrets remain in the operator namespace; delete any stragglers
5 — Upgrade VSO	Upgrade the operator via Helm or Kustomize to the new version without HCP support
6 — Delete HCP CRDs	Permanently remove both hcpauths and hcpvaultsecretsapps CRDs from the cluster
7 — Remove RBAC (optional)	Delete the four HCP-specific ClusterRole objects left behind by the old operator

---

Path B — After Upgrade (Recovery)

Step	Summary
Diagnose	Check which HCP CRs, CRDs, and shadow secrets are still present on the cluster
1 — Patch & delete HCPVaultSecretsApps	Strip the finalizer from every instance first (prevents Terminating hang), then delete all
2 — Delete HCPAuths	Delete all HCPAuth instances cluster-wide (no finalizer, always safe)
3 — Clean shadow secrets	Delete all vso-hvs-* secrets from the operator namespace
4 — Delete HCP CRDs	Permanently remove both HCP CRDs once all CR instances are gone
5 — Remove RBAC (optional)	Delete the four HCP-specific ClusterRole objects

---

Key difference: In Path A the running controller handles finalizer removal automatically on delete.
In Path B you must manually patch finalizers off every HCPVaultSecretsApp before deleting,
otherwise they hang in Terminating indefinitely.

---

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.