Repository navigation
Conversation
|
🚀 Merging this PR will release Merging will trigger workflows 🛠️ Auto tagging enabled with label |
simu
force-pushed
the
feat/icr-credentials
branch
5 times, most recently
from
November 3, 2026 16:09
89cb1a8 to
946da77
Compare
The component supports three different types of credentials: static, direct-eso, and projectsyn. The component adds the credentials to the OpenShift cluster-wide pull secret via the Espejote ManagedResource defined in component-openshift4-config. For credential type `static`, the component deploys a Secret that's populated with a static access token that's stored in Vault. Because we can't pre-compute a valid `dockerconfigjson` value before revealing the Vault references, the component deploys an Espejote ManagedResource which takes the static credentials and renders them as a `dockerconfigjson`. For credential type `direct-eso`, the component requires that component-external-secrets-operator is present on the cluster and configures an ESO webhook generator which is configured to request new access tokens from the Isovalent container registry and an ExternalSecret which uses the generator to render the Cilium pull secret that's merged into the cluster-wide pull secret. For this credential type, the component requires that parameter `enterprise.registry.hostname` is set to `containers.isovalent.com`. For credential type `projectsyn`, the component deploys an Espejote ManagedResource which takes the provided registry hostname and username, and configures the registry password as the SHA-256 hash of the cluster's Steward token. For this credential type, the component requires that parameter `enterprise.registry.hostname` is set to something other than `containers.isovalent.com`.
Rendered from template version: main (d0e9f8d)
Deploy a `ImageTagMirrorSet` and `ImageDigestMirrorSet` custom resource with `mirrorSourcePolicy: NeverContactSource` to ensure that all image pulls for containers.isovalent.com are redirected to the mirror when parameter `enterprise.registry.hostname` is set to anything other than `containers.isovalent.com`.
simu
force-pushed
the
feat/icr-credentials
branch
from
November 4, 2026 14:19
dad53ba to
eee3fa3
Compare
simu
marked this pull request as ready for review
November 4, 2026 14:19
Member
Author
|
I've tested the manifests for the |
HappyTetrahedron
approved these changes
Nov 4, 2026
| isovalent_registry_mirror_config: [ | ||
| kube._Object( | ||
| 'config.openshift.io/v1', | ||
| 'ImageTagMirrorSet', |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Container images for Cilium Enterprise (Isovalent Networking for Kubernetes) 1.19 and newer are only available from containers.isovalent.com with suitable registry credentials.
This PR enhances the component to enable users to manage credentials for the INK container registry and also support configuring a registry mirror on OpenShift via
ImageTagMirrorSetandImageDigestMirrorSet(so we don't need to find all Helm values that refer to containers.isovalent.com and modify them to point to the registry mirror).TODO
generators.external-secrets.io/v1alpha1component-external-secrets-operator#19 is mergedChecklist
changelog.
The PR has a meaningful description that sums up the change. It will be
linked in the changelog.
bug,enhancement,documentation,change,breaking,dependencyas they show up in the changelog.