From 33ae7a210463d2d7ef4ca0987e2894d3dbedd4aa Mon Sep 17 00:00:00 2001
From: Mukul Sharma <mukul.sharma909.ms@gmail.com>
Date: Wed, 2 Sep 2026 23:54:50 +0530
Subject: [PATCH] Add demo-go-app-image-pull-secret; rekey
 harbor-robot-dockerconfig
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both needed for the registry hostname switch to
harbor.192.168.1.7.nip.io (devops-lib#3ffa2d8):

- harbor-robot-dockerconfig's auths key was hardcoded to
  harbor-core.harbor.svc.cluster.local — docker matches stored
  credentials by exact registry hostname, so this had to move with
  the image reference or push would go back to unauthorized.
- New demo-go-app-image-pull-secret, in the demo-go-app namespace
  (imagePullSecrets must be same-namespace as the pod), for the
  Deployment's own pull — separate from harbor-robot-dockerconfig,
  which only ever lived in the jenkins namespace for the build pod's
  push. Same underlying robot account/Vault path.
---
 .../demo-go-app-image-pull-secret.yaml        | 35 +++++++++++++++++++
 secretstores/harbor-robot-dockerconfig.yaml   |  8 ++++-
 2 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 secretstores/demo-go-app-image-pull-secret.yaml

diff --git a/secretstores/demo-go-app-image-pull-secret.yaml b/secretstores/demo-go-app-image-pull-secret.yaml
new file mode 100644
index 0000000..867e58b
--- /dev/null
+++ b/secretstores/demo-go-app-image-pull-secret.yaml
@@ -0,0 +1,35 @@
+# imagePullSecret for demo-go-app's own Deployment — separate from
+# harbor-robot-dockerconfig (which lives in the jenkins namespace, for
+# the build pod's docker push). This one lands in the demo-go-app
+# namespace itself, since imagePullSecrets must be in the same namespace
+# as the pod referencing them. Same underlying robot account/Vault path
+# (harbor/jenkins-robot already has push+pull scope), just synced to a
+# second namespace and keyed to the same Contour ingress hostname used
+# for the image reference in values/demo-go-app/demo-go-app/values.yaml.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: demo-go-app-image-pull-secret
+  namespace: demo-go-app
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault-backend
+    kind: ClusterSecretStore
+  target:
+    name: demo-go-app-image-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: harbor/jenkins-robot
+        property: password
diff --git a/secretstores/harbor-robot-dockerconfig.yaml b/secretstores/harbor-robot-dockerconfig.yaml
index 8929209..b91ec98 100644
--- a/secretstores/harbor-robot-dockerconfig.yaml
+++ b/secretstores/harbor-robot-dockerconfig.yaml
@@ -27,8 +27,14 @@ spec:
     template:
       type: kubernetes.io/dockerconfigjson
       data:
+        # Keyed by exact registry hostname — docker matches credentials
+        # against the host portion of the image reference. Was
+        # harbor-core.harbor.svc.cluster.local; switched to the Contour
+        # ingress hostname alongside buildDocker.groovy and dind-pod.yaml
+        # so push/pull share one consistent, resolvable-from-anywhere
+        # reference.
         .dockerconfigjson: |
-          {"auths":{"harbor-core.harbor.svc.cluster.local":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
+          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
   data:
     - secretKey: username
       remoteRef: