From 092d1ac209d770b026fa74692e50bbea2561203a Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Thu, 4 Jun 2026 23:44:00 -0500
Subject: [PATCH] Document robot credential management via 1Password and
 ExternalSecrets

Updated README to reflect the full workflow:
1. Robot account creation via Job
2. Secret regeneration and capture
3. Storage in 1Password (harbor-robot-accounts item)
4. Automatic sync via ExternalSecrets to K8s
---
 cluster/platform/harbor/README.md | 36 +++++++++++++++++++++++--------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/cluster/platform/harbor/README.md b/cluster/platform/harbor/README.md
index 4f95093..571c43c 100644
--- a/cluster/platform/harbor/README.md
+++ b/cluster/platform/harbor/README.md
@@ -45,18 +45,36 @@ The Job:
 
 **Note:** ArgoCD PostSync hooks don't currently trigger with multi-source applications, so the Job must be run manually after initial deployment or when robot account definitions change.
 
-### Retrieving Robot Credentials
+### Managing Robot Credentials
 
-Robot account secrets are only returned on creation. To regenerate a secret:
+Robot account secrets are managed through 1Password and synced via ExternalSecrets:
 
-```bash
-curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
-  "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/<robot_id>" \
-  -H "Content-Type: application/json" \
-  -d '{"secret": ""}' | jq -r '.secret'
-```
+1. **Initial Setup:** After running `robot-accounts-sync.yaml`, regenerate secrets to capture full values:
+   ```bash
+   # Regenerate tekton-builder secret (robot ID: 3)
+   curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
+     "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/3" \
+     -H "Content-Type: application/json" \
+     -d '{"secret": ""}' | jq -r '.secret'
+   
+   # Regenerate fastpass-cluster secret (robot ID: 4)
+   curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
+     "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/4" \
+     -H "Content-Type: application/json" \
+     -d '{"secret": ""}' | jq -r '.secret'
+   ```
 
-Store secrets in 1Password (mk-labs vault, item: `harbor-robot-accounts`).
+2. **Store in 1Password:** Create item `harbor-robot-accounts` in mk-labs vault with fields:
+   - `tekton-builder-username`: `robot$tekton-builder`
+   - `tekton-builder-password`: (secret from above)
+   - `fastpass-cluster-username`: `robot$fastpass-cluster`
+   - `fastpass-cluster-password`: (secret from above)
+
+3. **ExternalSecrets:** Two ExternalSecrets automatically sync credentials from 1Password:
+   - `externalsecret-tekton-robot.yaml` → creates `harbor-tekton-robot` secret
+   - `externalsecret-pull-secret.yaml` → creates `harbor-pull-secret` secret
+   
+   Both create `kubernetes.io/dockerconfigjson` type secrets ready for use.
 
 ## Network & TLS