oci-registry-secret review

deploy/flux/icarus-mngt/secrets/.env.d/.gitignore

@@ -1,2 +1,3 @@
 **
 !.gitignore
+!**.example.**

deploy/flux/icarus-mngt/secrets/.env.d/oci-registry-secret.example.json

@@ -0,0 +1,8 @@
+{
+    "auths": {
+        "xxx.xxx.con": {
+            "username": "xxxx",
+            "password": "xxxx"
+        }
+    }
+}

deploy/flux/icarus-mngt/secrets/kustomization.yaml

@@ -11,6 +11,9 @@ secretGenerator:
     files:
       - vault-pass.txt=.env.d/ansible-vault-pass.txt
       - ansible_become_password=.env.d/ansible_become_password
+  - name: oci-registry-secret
+    files:
+      - .dockerconfigjson=.env.d/oci-registry-secret.json
 generatorOptions:
   disableNameSuffixHash: true
 

deploy/icarus-mngt/workflowTemplates/icarus-ansible-script.yaml

@@ -10,9 +10,8 @@ metadata:
 spec:
   serviceAccountName: argo-runner
   imagePullSecrets:
-    - name: oci-mylimbo-infra-icarus-credentials
+    - name: oci-registry-secret
   entrypoint: raw-source
-
   templates:
     - name: raw-source
       inputs:

icarus-mngt/workflows/tests-download-private-oci.yaml

@@ -0,0 +1,38 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Workflow
+metadata:
+  generateName: tests-download-private-oci-
+  namespace: icarus-nodes-mngt  
+  labels:
+    workflows.argoproj.io/archive-strategy: "false"
+  annotations:
+    workflows.argoproj.io/description: |
+      tests
+spec:
+  entrypoint: exec
+  serviceAccountName: argo-runner
+  imagePullSecrets:
+  - name: oci-registry-secret
+  templates:
+    - name: exec
+      script:
+        image: alpine:latest
+        command: ["sh"] 
+        source: |
+          #!/bin/sh
+          ls -lah /mnt
+        resources:
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+        volumeMounts:
+          - name: oci-image
+            mountPath: /mnt
+      volumes:
+      - name: oci-image
+        image:
+          reference: oci.limbosolutions.com/mylimbo.infra.icarus/ansible-inventory:latest 
+          pullPolicy: Always