Support for managing containers.isovalent.com credentials and registry mirror

.cruft.json

@@ -1,13 +1,13 @@
 {
   "template": "https://github.com/projectsyn/commodore-component-template.git",
-  "commit": "e181d48cf389cc0db56825e47044d881c8e91e4d",
+  "commit": "d0e9f8dc2b85344a283aea02369d3ec7548e388d",
   "checkout": "main",
   "context": {
     "cookiecutter": {
       "name": "Cilium",
       "slug": "cilium",
       "parameter_key": "cilium",
-      "test_cases": "defaults helm-opensource egress-gateway bgp-control-plane kubeproxyreplacement-strict l2-announcement clustermesh enterprise-bgp hubble-access lib-ipcalc olm-enterprise transparent-encryption talos custom-namespace",
+      "test_cases": "defaults helm-opensource egress-gateway bgp-control-plane kubeproxyreplacement-strict l2-announcement clustermesh enterprise-bgp hubble-access lib-ipcalc olm-enterprise transparent-encryption talos custom-namespace projectsyn-registry-credentials",
       "add_lib": "n",
       "add_pp": "n",
       "add_golden": "y",
@@ -25,7 +25,7 @@
       "github_name": "component-cilium",
       "github_url": "https://github.com/projectsyn/component-cilium",
       "_template": "https://github.com/projectsyn/commodore-component-template.git",
-      "_commit": "e181d48cf389cc0db56825e47044d881c8e91e4d"
+      "_commit": "d0e9f8dc2b85344a283aea02369d3ec7548e388d"
     }
   },
   "directory": null

.github/workflows/test.yaml

@@ -45,6 +45,7 @@ jobs:
           - transparent-encryption
           - talos
           - custom-namespace
+          - projectsyn-registry-credentials
     defaults:
       run:
         working-directory: ${{ env.COMPONENT_NAME }}
@@ -73,6 +74,7 @@ jobs:
           - transparent-encryption
           - talos
           - custom-namespace
+          - projectsyn-registry-credentials
     defaults:
       run:
         working-directory: ${{ env.COMPONENT_NAME }}

Makefile.vars.mk

@@ -57,4 +57,4 @@ KUBENT_IMAGE    ?= ghcr.io/doitintl/kube-no-trouble:latest
 KUBENT_DOCKER   ?= $(DOCKER_CMD) $(DOCKER_ARGS) $(root_volume) --entrypoint=/app/kubent $(KUBENT_IMAGE)
 
 instance ?= defaults
-test_instances = tests/defaults.yml tests/helm-opensource.yml tests/egress-gateway.yml tests/bgp-control-plane.yml tests/kubeproxyreplacement-strict.yml tests/l2-announcement.yml tests/clustermesh.yml tests/enterprise-bgp.yml tests/hubble-access.yml tests/lib-ipcalc.yml tests/olm-enterprise.yml tests/transparent-encryption.yml tests/talos.yml tests/custom-namespace.yml
+test_instances = tests/defaults.yml tests/helm-opensource.yml tests/egress-gateway.yml tests/bgp-control-plane.yml tests/kubeproxyreplacement-strict.yml tests/l2-announcement.yml tests/clustermesh.yml tests/enterprise-bgp.yml tests/hubble-access.yml tests/lib-ipcalc.yml tests/olm-enterprise.yml tests/transparent-encryption.yml tests/talos.yml tests/custom-namespace.yml tests/projectsyn-registry-credentials.yml

class/cilium.yml

@@ -14,6 +14,7 @@ parameters:
       - ${_base_directory}/component/alerts.jsonnet
       - ${_base_directory}/component/rbac.jsonnet
       - ${_base_directory}/component/cert-manager-ca.jsonnet
+      - ${_base_directory}/component/enterprise.jsonnet
     olm:
       dependencies:
         - type: https

class/defaults.yml

@@ -120,6 +120,15 @@ parameters:
 
     deploy_cert_manager_ca: false
 
+    enterprise:
+      registry:
+        hostname: containers.isovalent.com
+        credentials:
+          # options: "static", "direct-eso", "projectsyn"
+          type: static
+          username: ?{vaultkv:${cluster:tenant}/${cluster:name}/isovalent/username}
+          access_token: ?{vaultkv:${cluster:tenant}/${cluster:name}/isovalent/access_token}
+
     olm:
       source:
         opensource: https://github.com/isovalent/olm-for-cilium/archive/main.tar.gz

component/enterprise.jsonnet

@@ -0,0 +1,14 @@
+local kap = import 'lib/kapitan.libjsonnet';
+
+local inv = kap.inventory();
+local params = inv.parameters.cilium;
+
+local icr_config = import 'icr-config.libsonnet';
+
+if params.release == 'enterprise' then
+  {
+    ['80_enterprise_%s' % k]: icr_config[k]
+    for k in std.objectFields(icr_config)
+  }
+else
+  {}

component/espejote-templates/cilium-pull-secret.jsonnet

@@ -0,0 +1,62 @@
+local esp = import 'espejote.libsonnet';
+
+local read_context_secret(ctxname) =
+  if ctxname in esp.context() then
+    local secret = esp.context()[ctxname];
+    assert std.length(secret) == 1 : 'Expected %s context to have length 1' % ctxname;
+    secret[0]
+  else
+    null;
+
+local config =
+  local secret = read_context_secret('isovalent_registry_config');
+  assert secret != null : 'Context isovalent_registry_config missing';
+  assert
+    std.objectHas(secret.data, 'hostname')
+    && std.objectHas(secret.data, 'username')
+    && std.objectHas(secret.data, 'pull_secret_name')
+    : 'Expected Isovalent registry config secret to have fields `hostname`, `username` and `pull_secret_name`';
+  {
+    [k]: std.base64Decode(secret.data[k])
+    for k in std.objectFields(secret.data)
+  };
+
+local access_token =
+  local steward_token =
+    local secret = read_context_secret('steward_token');
+    assert secret != null : 'Context steward_token missing';
+    assert std.objectHas(secret.data, 'token') : 'Expected Steward token secret to have field `token`';
+    std.base64Decode(secret.data.token);
+  // NOTE(sg): This should make the template suitable for both 'static' and
+  // 'projectsyn' credentials type. We read the access token from the config
+  // secret, if it's present (which it is for credentials type 'static'), and
+  // fall back to the steward token otherwise.
+  std.get(config, 'access_token', std.sha256(steward_token));
+
+{
+  apiVersion: 'v1',
+  kind: 'Secret',
+  metadata: {
+    name: config.pull_secret_name,
+    namespace: 'openshift-config',
+    labels: {
+      'pull-secret.openshift-config.syn.tools/include': '',
+      'app.kubernetes.io/managed-by': 'espejote',
+    },
+  },
+  type: 'kubernetes.io/dockerconfigjson',
+  stringData: {
+    '.dockerconfigjson': std.manifestJsonMinified({
+      auths: {
+        [config.hostname]: {
+          auth: std.base64(
+            '%(username)s:%(password)s' % {
+              username: config.username,
+              password: access_token,
+            }
+          ),
+        },
+      },
+    }),
+  },
+}