6acf2f9944
Creates two docker-registry secrets from 1Password: 1. harbor-tekton-robot - for Tekton CI/CD pipeline push/pull 2. harbor-pull-secret - for fastpass cluster image pulls Both sync from 1Password item 'harbor-robot-accounts' with fields: - tekton-builder-username / tekton-builder-password - fastpass-cluster-username / fastpass-cluster-password Credentials document placed in PKA inbox for manual 1Password entry. Once stored, ESO will automatically sync and create the secrets.
39 lines
1.1 KiB
YAML
39 lines
1.1 KiB
YAML
# ExternalSecret for Tekton robot account credentials
|
|
# Syncs from 1Password item: harbor-robot-accounts
|
|
# Creates a docker-registry type secret for Tekton pipeline authentication
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: harbor-tekton-robot
|
|
namespace: harbor
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
name: onepassword-store
|
|
kind: ClusterSecretStore
|
|
target:
|
|
name: harbor-tekton-robot
|
|
creationPolicy: Owner
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"the-seas.local.mk-labs.cloud": {
|
|
"username": "{{ .tekton_username }}",
|
|
"password": "{{ .tekton_password }}",
|
|
"auth": "{{ printf "%s:%s" .tekton_username .tekton_password | b64enc }}"
|
|
}
|
|
}
|
|
}
|
|
data:
|
|
- secretKey: tekton_username
|
|
remoteRef:
|
|
key: harbor-robot-accounts
|
|
property: tekton-builder-username
|
|
- secretKey: tekton_password
|
|
remoteRef:
|
|
key: harbor-robot-accounts
|
|
property: tekton-builder-password
|