rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document robot credential management via 1Password and ExternalSecrets

Browse Source 
Updated README to reflect the full workflow:
1. Robot account creation via Job
2. Secret regeneration and capture
3. Storage in 1Password (harbor-robot-accounts item)
4. Automatic sync via ExternalSecrets to K8s
This commit is contained in:
Hermes Agent service account
2026-06-04 23:44:00 -05:00
parent 6acf2f9944
commit 092d1ac209
1 changed files with 27 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
cluster/platform/harbor/README.md
View File

@@ -45,18 +45,36 @@ The Job:
**Note:** ArgoCD PostSync hooks don't currently trigger with multi-source applications, so the Job must be run manually after initial deployment or when robot account definitions change. **Note:** ArgoCD PostSync hooks don't currently trigger with multi-source applications, so the Job must be run manually after initial deployment or when robot account definitions change.
### Retrieving Robot Credentials ### Managing Robot Credentials
Robot account secrets are only returned on creation. To regenerate a secret: Robot account secrets are managed through 1Password and synced via ExternalSecrets:
```bash 1. **Initial Setup:** After running `robot-accounts-sync.yaml`, regenerate secrets to capture full values:
curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \ ```bash
"https://the-seas.local.mk-labs.cloud/api/v2.0/robots/<robot_id>" \ # Regenerate tekton-builder secret (robot ID: 3)
-H "Content-Type: application/json" \ curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
-d '{"secret": ""}' | jq -r '.secret' "https://the-seas.local.mk-labs.cloud/api/v2.0/robots/3" \
``` -H "Content-Type: application/json" \
-d '{"secret": ""}' | jq -r '.secret'
# Regenerate fastpass-cluster secret (robot ID: 4)
curl -k -u "admin:${HARBOR_ADMIN_PASSWORD}" -X PATCH \
"https://the-seas.local.mk-labs.cloud/api/v2.0/robots/4" \
-H "Content-Type: application/json" \
-d '{"secret": ""}' | jq -r '.secret'
```
Store secrets in 1Password (mk-labs vault, item: `harbor-robot-accounts`). 2. **Store in 1Password:** Create item `harbor-robot-accounts` in mk-labs vault with fields:
- `tekton-builder-username`: `robot$tekton-builder`
- `tekton-builder-password`: (secret from above)
- `fastpass-cluster-username`: `robot$fastpass-cluster`
- `fastpass-cluster-password`: (secret from above)
3. **ExternalSecrets:** Two ExternalSecrets automatically sync credentials from 1Password:
- `externalsecret-tekton-robot.yaml` → creates `harbor-tekton-robot` secret
- `externalsecret-pull-secret.yaml` → creates `harbor-pull-secret` secret
Both create `kubernetes.io/dockerconfigjson` type secrets ready for use.
## Network & TLS ## Network & TLS