From 6acf2f99444faab6c8fbace978dee3d331fff241 Mon Sep 17 00:00:00 2001
From: Hermes Agent service account
 <hermes@carousel-of-progress.local.mk-labs.cloud>
Date: Thu, 4 Jun 2026 23:43:37 -0500
Subject: [PATCH] Add ExternalSecrets for Harbor robot account credentials

Creates two docker-registry secrets from 1Password:
1. harbor-tekton-robot - for Tekton CI/CD pipeline push/pull
2. harbor-pull-secret - for fastpass cluster image pulls

Both sync from 1Password item 'harbor-robot-accounts' with fields:
- tekton-builder-username / tekton-builder-password
- fastpass-cluster-username / fastpass-cluster-password

Credentials document placed in PKA inbox for manual 1Password entry.
Once stored, ESO will automatically sync and create the secrets.
---
 .../harbor/externalsecret-pull-secret.yaml    | 38 +++++++++++++++++++
 .../harbor/externalsecret-tekton-robot.yaml   | 38 +++++++++++++++++++
 2 files changed, 76 insertions(+)
 create mode 100644 cluster/platform/harbor/externalsecret-pull-secret.yaml
 create mode 100644 cluster/platform/harbor/externalsecret-tekton-robot.yaml

diff --git a/cluster/platform/harbor/externalsecret-pull-secret.yaml b/cluster/platform/harbor/externalsecret-pull-secret.yaml
new file mode 100644
index 0000000..02c1d50
--- /dev/null
+++ b/cluster/platform/harbor/externalsecret-pull-secret.yaml
@@ -0,0 +1,38 @@
+# ExternalSecret for fastpass cluster image pull credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Kubernetes image pulls
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-pull-secret
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .fastpass_username }}",
+                "password": "{{ .fastpass_password }}",
+                "auth": "{{ printf "%s:%s" .fastpass_username .fastpass_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: fastpass_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-username
+    - secretKey: fastpass_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: fastpass-cluster-password
diff --git a/cluster/platform/harbor/externalsecret-tekton-robot.yaml b/cluster/platform/harbor/externalsecret-tekton-robot.yaml
new file mode 100644
index 0000000..d0a0962
--- /dev/null
+++ b/cluster/platform/harbor/externalsecret-tekton-robot.yaml
@@ -0,0 +1,38 @@
+# ExternalSecret for Tekton robot account credentials
+# Syncs from 1Password item: harbor-robot-accounts
+# Creates a docker-registry type secret for Tekton pipeline authentication
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: harbor-tekton-robot
+  namespace: harbor
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword-store
+    kind: ClusterSecretStore
+  target:
+    name: harbor-tekton-robot
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {
+            "auths": {
+              "the-seas.local.mk-labs.cloud": {
+                "username": "{{ .tekton_username }}",
+                "password": "{{ .tekton_password }}",
+                "auth": "{{ printf "%s:%s" .tekton_username .tekton_password | b64enc }}"
+              }
+            }
+          }
+  data:
+    - secretKey: tekton_username
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-username
+    - secretKey: tekton_password
+      remoteRef:
+        key: harbor-robot-accounts
+        property: tekton-builder-password