Mukul Sharma
33ae7a2104
Both needed for the registry hostname switch to harbor.192.168.1.7.nip.io (devops-lib#3ffa2d8): - harbor-robot-dockerconfig's auths key was hardcoded to harbor-core.harbor.svc.cluster.local — docker matches stored credentials by exact registry hostname, so this had to move with the image reference or push would go back to unauthorized. - New demo-go-app-image-pull-secret, in the demo-go-app namespace (imagePullSecrets must be same-namespace as the pod), for the Deployment's own pull — separate from harbor-robot-dockerconfig, which only ever lived in the jenkins namespace for the build pod's push. Same underlying robot account/Vault path.
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
# imagePullSecret for demo-go-app's own Deployment — separate from
|
|
# harbor-robot-dockerconfig (which lives in the jenkins namespace, for
|
|
# the build pod's docker push). This one lands in the demo-go-app
|
|
# namespace itself, since imagePullSecrets must be in the same namespace
|
|
# as the pod referencing them. Same underlying robot account/Vault path
|
|
# (harbor/jenkins-robot already has push+pull scope), just synced to a
|
|
# second namespace and keyed to the same Contour ingress hostname used
|
|
# for the image reference in values/demo-go-app/demo-go-app/values.yaml.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: demo-go-app-image-pull-secret
|
|
namespace: demo-go-app
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: vault-backend
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: demo-go-app-image-pull-secret
|
|
creationPolicy: Owner
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: |
|
|
{"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
|
|
data:
|
|
- secretKey: username
|
|
remoteRef:
|
|
key: harbor/jenkins-robot
|
|
property: username
|
|
- secretKey: password
|
|
remoteRef:
|
|
key: harbor/jenkins-robot
|
|
property: password
|