Skip to content

Commit 164401b

Browse files
ArthurVardevanyanArthurVardevanyan
committed
feat(ESO): Use Quay Access Token
1 parent cf99359 commit 164401b

File tree

5 files changed

+217
-16
lines changed

5 files changed

+217
-16
lines changed

‎containers/toolbox/containerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ ENV \
1818
PRETTIER_CLI_VERSION=3.3.3 \
1919
HOME=/tmp \
2020
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/go/bin \
21-
KICK="1"
21+
KICK="0"
2222

2323
RUN rpm -Uvh https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm && \
2424
rpm -ivh https://github.com/opentofu/opentofu/releases/download/v${OPENTOFU_VERSION}/tofu_${OPENTOFU_VERSION}_amd64.rpm && \

‎kubernetes/external-secrets-operator/components/helm/crd.yaml

+155-1
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ spec:
155155
- Fake
156156
- GCRAccessToken
157157
- GithubAccessToken
158+
- QuayAccessToken
158159
- Password
159160
- STSSessionToken
160161
- UUID
@@ -341,6 +342,7 @@ spec:
341342
- Fake
342343
- GCRAccessToken
343344
- GithubAccessToken
345+
- QuayAccessToken
344346
- Password
345347
- STSSessionToken
346348
- UUID
@@ -6939,6 +6941,7 @@ spec:
69396941
- Fake
69406942
- GCRAccessToken
69416943
- GithubAccessToken
6944+
- QuayAccessToken
69426945
- Password
69436946
- STSSessionToken
69446947
- UUID
@@ -7125,6 +7128,7 @@ spec:
71257128
- Fake
71267129
- GCRAccessToken
71277130
- GithubAccessToken
7131+
- QuayAccessToken
71287132
- Password
71297133
- STSSessionToken
71307134
- UUID
@@ -7593,6 +7597,7 @@ spec:
75937597
- Fake
75947598
- GCRAccessToken
75957599
- GithubAccessToken
7600+
- QuayAccessToken
75967601
- Password
75977602
- STSSessionToken
75987603
- UUID
@@ -14037,7 +14042,7 @@ spec:
1403714042
- auth
1403814043
- registry
1403914044
type: object
14040-
ecrRAuthorizationTokenSpec:
14045+
ecrAuthorizationTokenSpec:
1404114046
properties:
1404214047
auth:
1404314048
description: Auth defines how to authenticate with AWS
@@ -14170,6 +14175,11 @@ spec:
1417014175
You can assume a role before making calls to the
1417114176
desired AWS service.
1417214177
type: string
14178+
scope:
14179+
description: |-
14180+
Scope specifies the ECR service scope.
14181+
Valid options are private and public.
14182+
type: string
1417314183
required:
1417414184
- region
1417514185
type: object
@@ -14374,6 +14384,46 @@ spec:
1437414384
- length
1437514385
- noUpper
1437614386
type: object
14387+
quayAccessTokenSpec:
14388+
properties:
14389+
robotAccount:
14390+
description: Name of the robot account you are federating with
14391+
type: string
14392+
serviceAccountRef:
14393+
description: Name of the service account you are federating with
14394+
properties:
14395+
audiences:
14396+
description: |-
14397+
Audience specifies the `aud` claim for the service account token
14398+
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
14399+
then this audiences will be appended to the list
14400+
items:
14401+
type: string
14402+
type: array
14403+
name:
14404+
description: The name of the ServiceAccount resource being referred to.
14405+
maxLength: 253
14406+
minLength: 1
14407+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
14408+
type: string
14409+
namespace:
14410+
description: |-
14411+
Namespace of the resource being referred to.
14412+
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
14413+
maxLength: 63
14414+
minLength: 1
14415+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
14416+
type: string
14417+
required:
14418+
- name
14419+
type: object
14420+
url:
14421+
description: URL configures the Quay instance URL. Defaults to https://quay.io/.
14422+
type: string
14423+
required:
14424+
- robotAccount
14425+
- serviceAccountRef
14426+
type: object
1437714427
stsSessionTokenSpec:
1437814428
properties:
1437914429
auth:
@@ -15445,6 +15495,7 @@ spec:
1544515495
- Fake
1544615496
- GCRAccessToken
1544715497
- GithubAccessToken
15498+
- QuayAccessToken
1544815499
- Password
1544915500
- STSSessionToken
1545015501
- UUID
@@ -15652,6 +15703,11 @@ spec:
1565215703
You can assume a role before making calls to the
1565315704
desired AWS service.
1565415705
type: string
15706+
scope:
15707+
description: |-
15708+
Scope specifies the ECR service scope.
15709+
Valid options are private and public.
15710+
type: string
1565515711
required:
1565615712
- region
1565715713
type: object
@@ -16113,6 +16169,104 @@ spec:
1611316169
---
1611416170
apiVersion: apiextensions.k8s.io/v1
1611516171
kind: CustomResourceDefinition
16172+
metadata:
16173+
annotations:
16174+
controller-gen.kubebuilder.io/version: v0.16.5
16175+
labels:
16176+
external-secrets.io/component: controller
16177+
name: quayaccesstokens.generators.external-secrets.io
16178+
spec:
16179+
group: generators.external-secrets.io
16180+
names:
16181+
categories:
16182+
- external-secrets
16183+
- external-secrets-generators
16184+
kind: QuayAccessToken
16185+
listKind: QuayAccessTokenList
16186+
plural: quayaccesstokens
16187+
singular: quayaccesstoken
16188+
scope: Namespaced
16189+
versions:
16190+
- name: v1alpha1
16191+
schema:
16192+
openAPIV3Schema:
16193+
description: QuayAccessToken generates Quay oauth token for pulling/pushing images
16194+
properties:
16195+
apiVersion:
16196+
description: |-
16197+
APIVersion defines the versioned schema of this representation of an object.
16198+
Servers should convert recognized schemas to the latest internal value, and
16199+
may reject unrecognized values.
16200+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
16201+
type: string
16202+
kind:
16203+
description: |-
16204+
Kind is a string value representing the REST resource this object represents.
16205+
Servers may infer this from the endpoint the client submits requests to.
16206+
Cannot be updated.
16207+
In CamelCase.
16208+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
16209+
type: string
16210+
metadata:
16211+
type: object
16212+
spec:
16213+
properties:
16214+
robotAccount:
16215+
description: Name of the robot account you are federating with
16216+
type: string
16217+
serviceAccountRef:
16218+
description: Name of the service account you are federating with
16219+
properties:
16220+
audiences:
16221+
description: |-
16222+
Audience specifies the `aud` claim for the service account token
16223+
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
16224+
then this audiences will be appended to the list
16225+
items:
16226+
type: string
16227+
type: array
16228+
name:
16229+
description: The name of the ServiceAccount resource being referred to.
16230+
maxLength: 253
16231+
minLength: 1
16232+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
16233+
type: string
16234+
namespace:
16235+
description: |-
16236+
Namespace of the resource being referred to.
16237+
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
16238+
maxLength: 63
16239+
minLength: 1
16240+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
16241+
type: string
16242+
required:
16243+
- name
16244+
type: object
16245+
url:
16246+
description: URL configures the Quay instance URL. Defaults to https://quay.io/.
16247+
type: string
16248+
required:
16249+
- robotAccount
16250+
- serviceAccountRef
16251+
type: object
16252+
type: object
16253+
served: true
16254+
storage: true
16255+
subresources:
16256+
status: {}
16257+
conversion:
16258+
strategy: Webhook
16259+
webhook:
16260+
conversionReviewVersions:
16261+
- v1
16262+
clientConfig:
16263+
service:
16264+
name: kubernetes
16265+
namespace: default
16266+
path: /convert
16267+
---
16268+
apiVersion: apiextensions.k8s.io/v1
16269+
kind: CustomResourceDefinition
1611616270
metadata:
1611716271
annotations:
1611816272
controller-gen.kubebuilder.io/version: v0.16.5

‎kubernetes/external-secrets-operator/components/helm/deployment.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ spec:
4040
runAsNonRoot: true
4141
seccompProfile:
4242
type: RuntimeDefault
43-
image: ghcr.io/external-secrets/external-secrets:v0.11.0@sha256:bf0747a7c8a9726a6757c185faa5a77bd0652f7aac03c9712c92fe7f26576431
43+
image: registry.arthurvardevanyan.com/homelab/external-secrets:quay-head@sha256:091b495923dd5b22509e8c419053b91f61ef5d871ed2c8612678b859d893e14b
4444
imagePullPolicy: IfNotPresent
4545
args:
4646
- certcontroller
@@ -113,7 +113,7 @@ spec:
113113
runAsNonRoot: true
114114
seccompProfile:
115115
type: RuntimeDefault
116-
image: ghcr.io/external-secrets/external-secrets:v0.11.0@sha256:bf0747a7c8a9726a6757c185faa5a77bd0652f7aac03c9712c92fe7f26576431
116+
image: registry.arthurvardevanyan.com/homelab/external-secrets:quay-head@sha256:091b495923dd5b22509e8c419053b91f61ef5d871ed2c8612678b859d893e14b
117117
imagePullPolicy: IfNotPresent
118118
args:
119119
- --concurrent=1
@@ -175,7 +175,7 @@ spec:
175175
runAsNonRoot: true
176176
seccompProfile:
177177
type: RuntimeDefault
178-
image: ghcr.io/external-secrets/external-secrets:v0.11.0@sha256:bf0747a7c8a9726a6757c185faa5a77bd0652f7aac03c9712c92fe7f26576431
178+
image: registry.arthurvardevanyan.com/homelab/external-secrets:quay-head@sha256:091b495923dd5b22509e8c419053b91f61ef5d871ed2c8612678b859d893e14b
179179
imagePullPolicy: IfNotPresent
180180
args:
181181
- webhook

‎kubernetes/external-secrets-operator/components/helm/rbac.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,7 @@ rules:
182182
- "fakes"
183183
- "gcraccesstokens"
184184
- "githubaccesstokens"
185+
- "quayaccesstokens"
185186
- "passwords"
186187
- "stssessiontokens"
187188
- "uuids"
@@ -277,6 +278,7 @@ rules:
277278
- "fakes"
278279
- "gcraccesstokens"
279280
- "githubaccesstokens"
281+
- "quayaccesstokens"
280282
- "passwords"
281283
- "vaultdynamicsecrets"
282284
- "webhooks"
@@ -321,6 +323,7 @@ rules:
321323
- "fakes"
322324
- "gcraccesstokens"
323325
- "githubaccesstokens"
326+
- "quayaccesstokens"
324327
- "passwords"
325328
- "vaultdynamicsecrets"
326329
- "webhooks"

‎tekton/base/push-secret.yaml

+55-11
Original file line numberDiff line numberDiff line change
@@ -8,17 +8,61 @@
88
# stringData:
99
# .dockerconfigjson: <path:secret/data/homelab/homelab#quay_push>
1010
# type: kubernetes.io/dockerconfigjson
11-
apiVersion: containerregistry.arthurvardevanyan.com/v1beta1
12-
kind: Auth
11+
# apiVersion: containerregistry.arthurvardevanyan.com/v1beta1
12+
# kind: Auth
13+
# metadata:
14+
# name: homelab-push-pull-secret
15+
# namespace: homelab
16+
# spec:
17+
# serviceAccount: pipeline
18+
# secretName: homelab-push-pull-secret
19+
# containerRegistry: quay
20+
# audiences:
21+
# - openshift
22+
# quay:
23+
# robotAccount: "homelab+push"
24+
# url: registry.arthurvardevanyan.com
25+
---
26+
apiVersion: generators.external-secrets.io/v1alpha1
27+
kind: QuayAccessToken
28+
metadata:
29+
name: homelab
30+
namespace: homelab
31+
annotations:
32+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
33+
spec:
34+
url: registry.arthurvardevanyan.com
35+
robotAccount: homelab+push
36+
serviceAccountRef:
37+
name: "pipeline"
38+
audiences:
39+
- openshift
40+
---
41+
apiVersion: external-secrets.io/v1beta1
42+
kind: ExternalSecret
1343
metadata:
14-
name: homelab-push-pull-secret
44+
name: homelab
1545
namespace: homelab
46+
annotations:
47+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
1648
spec:
17-
serviceAccount: pipeline
18-
secretName: homelab-push-pull-secret
19-
containerRegistry: quay
20-
audiences:
21-
- openshift
22-
quay:
23-
robotAccount: "homelab+push"
24-
url: registry.arthurvardevanyan.com
49+
dataFrom:
50+
- sourceRef:
51+
generatorRef:
52+
apiVersion: generators.external-secrets.io/v1alpha1
53+
kind: QuayAccessToken
54+
name: homelab
55+
refreshInterval: "55m" # Overlap with Token Expire
56+
target:
57+
name: homelab-push-pull-secret
58+
template:
59+
type: kubernetes.io/dockerconfigjson
60+
data:
61+
.dockerconfigjson: |
62+
{
63+
"auths": {
64+
"{{ .registry }}": {
65+
"auth": "{{ .auth }}"
66+
}
67+
}
68+
}

0 commit comments

Comments
 (0)