WIP Add POC deployment file

image-sync/oc-mirror/poc.yaml

@@ -1,15 +1,104 @@
 apiVersion: v1
+kind: Namespace
+metadata:
+  name: ocmirror-poc
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    azure.workload.identity/client-id: "REMOVED"
+  name: ocmirror-poc
+  namespace: ocmirror-poc
+---
+apiVersion: v1
 kind: Pod
 metadata:
-  creationTimestamp: null
   labels:
     run: ocmirror
+    azure.workload.identity/use: "true"
   name: ocmirror
+  namespace: ocmirror-poc
 spec:
+  initContainers:
+  - name: init-myservice
+    image: mcr.microsoft.com/azure-cli:cbl-mariner2.0
+    command: ['sh', '-c',
+              "az login --federated-token $(cat $AZURE_FEDERATED_TOKEN_FILE) --service-principal -u $AZURE_CLIENT_ID -t $AZURE_TENANT_ID; accessToken=$(az acr login --name devarohcp --expose-token | grep accessToken |cut -d ':' -f2| tr -d ' \",') ; cat /tmp/secret-orig/pull-secret | base64 -d  |sed \"s/TOKENTOBEREPLACED/$accessToken/\" > /etc/containers/auth.json",
+              ]
+    volumeMounts:
+    - name: pull-secrets-updated
+      mountPath: "/etc/containers"
+    - name: pull-secret
+      mountPath: "/tmp/secret-orig"
   containers:
-  - image: devarohcp.azurecr.io/image-sync/ocmirror:foobar
+  - image: devarohcp.azurecr.io/image-sync/ocmirror:a627f19
     name: ocmirror
-    resources: {}
-  dnsPolicy: ClusterFirst
-  restartPolicy: Always
+    command: ["oc-mirror", "--config", "/etc/ocmirror/imageset-config.yml", "docker://devarohcp.azurecr.io"]
+    env:
+      - name: XDG_RUNTIME_DIR
+        value: /etc/
+    volumeMounts:
+    - name: ocmirror-config
+      mountPath: "/etc/ocmirror"
+      readOnly: true
+    - name: pull-secrets-updated
+      mountPath: "/etc/containers"
+      readOnly: true
+    - name: workspace
+      mountPath: "/workspace"
+  volumes:
+  - name: ocmirror-config
+    configMap:
+      name: ocmirror-config
+  - name: workspace
+    emptyDir: {}
+  - name: pull-secrets-updated
+    emptyDir: {}
+  - name: pull-secret
+    csi:
+      driver: secrets-store.csi.k8s.io
+      readOnly: true
+      volumeAttributes:
+        secretProviderClass: "ocmirror-pullsecret"
+  serviceAccountName: ocmirror-poc
 status: {}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ocmirror-config
+  namespace: ocmirror-poc
+data:
+  imageset-config.yml: |
+    kind: ImageSetConfiguration
+    apiVersion: mirror.openshift.io/v1alpha2
+    storageConfig:
+      registry:
+        imageURL: devarohcp.azurecr.io/mirror/oc-mirror-metadata
+        skipTLS: false
+    mirror:
+      platform:
+        channels:
+          - name: stable-4.16
+            type: ocp
+        graph: true
+---
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: ocmirror-pullsecret
+  namespace: ocmirror-poc
+spec:
+  parameters:
+    clientID: REMOVED
+    cloudName: AzurePublicCloud
+    keyvaultName: jbolltesting
+    objects: |-
+      array:
+        - |
+          objectName: pull-secret
+          objectType: secret
+    tenantId: REMOVED
+    usePodIdentity: "false"
+  provider: azure