Image registry auth support

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argo-workflows/application.yaml

@@ -43,6 +43,7 @@ spec:
           pullPolicy: IfNotPresent
           pullSecrets:
             - name: proxy-docker-config
+            - name: docker-config
         mainContainer:
           resources:
             requests:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argo-workflows/externalsecret.yaml

@@ -40,25 +40,6 @@ spec:
 ---
 apiVersion: 'external-secrets.io/v1beta1'
 kind: ExternalSecret
-metadata:
-  name: container-registry-auth
-  annotations:
-    argocd.argoproj.io/sync-wave: '0'
-spec:
-  target:
-    name: container-registry-auth
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault-kv-secret
-  refreshInterval: 10s
-  data:
-    - remoteRef:
-        key: registry-auth
-        property: auth
-      secretKey: config.json
----
-apiVersion: 'external-secrets.io/v1beta1'
-kind: ExternalSecret
 metadata:
   name: docker-config
   annotations:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argocd/argocd-sa.yaml

@@ -0,0 +1,49 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-application-controller
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-applicationset-controller
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-notifications-controller
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-redis-ha
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-redis-ha-haproxy
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-repo-server
+imagePullSecrets:
+ - name: docker-config
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: argocd-server
+imagePullSecrets:
+ - name: docker-config

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argocd/externalsecrets.yaml

@@ -43,4 +43,28 @@ spec:
     - remoteRef:
         key: cd-secrets
         property: cd_webhook_secret
-      secretKey: cd_webhook_secret
+      secretKey: cd_webhook_secret
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/argocd/kustomization.yaml

@@ -15,6 +15,7 @@ patches:
 - path: argocd-cmd-params-cm.yaml
 - path: argocd-rbac-cm.yaml
 - path: argocd-secret.yaml
+- path: argocd-sa.yaml
 
 generatorOptions:
   disableNameSuffixHash: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/atlantis/application.yaml

@@ -69,6 +69,8 @@ spec:
             apply_requirements: [mergeable]
         volumeClaim:
           dataStorage: 20Gi
+        imagePullSecrets:
+         - docker-config
   destination:
     server: 'https://kubernetes.default.svc'
     namespace: atlantis

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/atlantis/externalsecret.yaml

@@ -30,4 +30,28 @@ spec:
   refreshInterval: 10s
   dataFrom:
     - extract:
-        key: /atlantis/basic-auth-secrets
+        key: /atlantis/basic-auth-secrets
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/backstage/application.yaml

@@ -21,7 +21,8 @@ spec:
           cg-devx.metadata.version: 1.17.0-next.2
         global:
           imageRegistry: ""
-          imagePullSecrets: []
+          imagePullSecrets: 
+            - docker-config
         kubeVersion: ""
         nameOverride: ""
         fullnameOverride: ""

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/backstage/externalsecret.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/kyverno/externalsecret.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/kyverno/kyverno.yaml

@@ -23,6 +23,9 @@ spec:
           cg-devx.metadata.service: policy-engine.kyverno
           cg-devx.metadata.chart-version: 3.2.7
           cg-devx.metadata.version: 1.12.6
+        global:
+          imagePullSecrets:
+           - name: docker-config
   syncPolicy:
     automated:
       prune: true

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/devsecops/trivy/trivy-operator.yaml

@@ -19,6 +19,9 @@ spec:
     helm:
       releaseName: trivy-operator
       values: |
+        image:
+          pullSecrets:
+            - name: docker-config
         trivy:
           ignoreUnfixed: false
           labels:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/harbor/externalsecret.yaml

@@ -1,4 +1,5 @@
-apiVersion: external-secrets.io/v1beta1
+---
+apiVersion: 'external-secrets.io/v1beta1'
 kind: ExternalSecret
 metadata:
   name: harbor-admin
@@ -14,3 +15,27 @@ spec:
   dataFrom:
     - extract:
         key: secret/harbor/admin-auth
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/harbor/harbor.yaml

@@ -20,6 +20,8 @@ spec:
       releaseName: harbor
       values: |
         externalURL: https://<REGISTRY_INGRESS_URL>
+        imagePullSecrets:
+          - name: docker-config
         expose:
           type: ingress
           tls:

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/kube-system/reloader/application.yaml

@@ -13,6 +13,9 @@ spec:
     chart: reloader
     helm:
       values: |-
+        global:
+          imagePullSecrets: 
+            - name: docker-config
         reloader:
           ignoreSecrets: false
           reloadStrategy: annotations

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/kube-system/reloader/externalsecret.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/kubecost/externalsecret.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/kubecost/kubecost.yaml

@@ -19,6 +19,8 @@ spec:
     helm:
       releaseName: kubecost
       values: |
+        imagePullSecrets:
+         - name: docker-config
         global:
           additionalLabels:
             cg-devx.cost-allocation.cost-center: platform

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/loki/externalsecret.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: 'external-secrets.io/v1beta1'
+kind: ExternalSecret
+metadata:
+  name: docker-config
+  annotations:
+    argocd.argoproj.io/sync-wave: '0'
+spec:
+  target:
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: "{{ .dockerconfig | toString }}"
+    name: docker-config
+    creationPolicy: Owner
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kv-secret
+  refreshInterval: 10s
+  data:
+  - secretKey: "dockerconfig"
+    remoteRef:
+      property: dockerconfig
+      key: dockerconfigjson

platform/gitops-pipelines/delivery/clusters/cc-cluster/core-services/components/loki/loki.yaml

@@ -16,6 +16,8 @@ spec:
     chart: loki
     helm:
       values: |-
+        imagePullSecrets: 
+          - name: docker-config
         loki:
           auth_enabled: false
           commonConfig: