Skip to content

Commit 06923b8

Browse files
datianshidatianshi
authored
operator [CI] ecr-secret-operator (0.4.1)
1 parent c55faa5 commit 06923b8

10 files changed

+554
-3
lines changed

‎operators/ecr-secret-operator/0.4.1/ecr-secret-operator-controller-manager-metrics-service_v1_service.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
creationTimestamp: null
5+
labels:
6+
control-plane: controller-manager
7+
name: ecr-secret-operator-controller-manager-metrics-service
8+
spec:
9+
ports:
10+
- name: https
11+
port: 8443
12+
protocol: TCP
13+
targetPort: https
14+
selector:
15+
control-plane: controller-manager
16+
status:
17+
loadBalancer: {}

‎operators/ecr-secret-operator/0.4.1/ecr-secret-operator-manager-config_v1_configmap.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
data:
3+
controller_manager_config.yaml: |
4+
apiVersion: controller-runtime.sigs.k8s.io/v1alpha1
5+
kind: ControllerManagerConfig
6+
health:
7+
healthProbeBindAddress: :8081
8+
metrics:
9+
bindAddress: 127.0.0.1:8080
10+
webhook:
11+
port: 9443
12+
leaderElection:
13+
leaderElect: true
14+
resourceName: bc9c1120.mobb.redhat.com
15+
kind: ConfigMap
16+
metadata:
17+
name: ecr-secret-operator-manager-config

‎operators/ecr-secret-operator/0.4.1/ecr-secret-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
creationTimestamp: null
5+
name: ecr-secret-operator-metrics-reader
6+
rules:
7+
- nonResourceURLs:
8+
- /metrics
9+
verbs:
10+
- get

‎operators/ecr-secret-operator/0.4.1/ecr-secret-operator.clusterserviceversion.yaml

Lines changed: 339 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,339 @@
1+
apiVersion: operators.coreos.com/v1alpha1
2+
kind: ClusterServiceVersion
3+
metadata:
4+
annotations:
5+
alm-examples: |-
6+
[
7+
{
8+
"apiVersion": "ecr.mobb.redhat.com/v1alpha1",
9+
"kind": "Secret",
10+
"metadata": {
11+
"name": "ecr-secret-sample",
12+
"namespace": "test-ecr-secret-operator"
13+
},
14+
"spec": {
15+
"ecr_registry": "ACCOUNT_ID.dkr.ecr.us-east-2.amazonaws.com",
16+
"frequency": "10h",
17+
"generated_secret_name": "ecr-docker-secret",
18+
"region": "us-east-2"
19+
}
20+
},
21+
{
22+
"apiVersion": "ecr.mobb.redhat.com/v1alpha1",
23+
"kind": "ArgoHelmRepoSecret",
24+
"metadata": {
25+
"labels": {
26+
"app.kubernetes.io/created-by": "ecr-secret-operator",
27+
"app.kubernetes.io/instance": "argohelmreposecret-sample",
28+
"app.kubernetes.io/managed-by": "kustomize",
29+
"app.kubernetes.io/name": "argohelmreposecret",
30+
"app.kubernetes.io/part-of": "ecr-secret-operator"
31+
},
32+
"name": "argohelmreposecret-sample"
33+
},
34+
"spec": null
35+
}
36+
]
37+
capabilities: Basic Install
38+
categories: Integration & Delivery
39+
containerImage: quay.io/mobb/ecr-secret-operator:v0.4.1
40+
createdAt: "2023-04-14T14:52:13Z"
41+
operatorframework.io/suggested-namespace: ecr-secret-operator
42+
operators.operatorframework.io/builder: operator-sdk-v1.28.0
43+
operators.operatorframework.io/project_layout: go.kubebuilder.io/v3
44+
repository: https://github.com/rh-mobb/ecr-secret-operator
45+
support: Managed Openshift Black Belt
46+
name: ecr-secret-operator.v0.4.1
47+
namespace: placeholder
48+
spec:
49+
apiservicedefinitions: {}
50+
customresourcedefinitions:
51+
owned:
52+
- description: ArgoHelmRepoSecret is the Schema for the argohelmreposecrets API
53+
displayName: Argo Helm Repo Secret
54+
kind: ArgoHelmRepoSecret
55+
name: argohelmreposecrets.ecr.mobb.redhat.com
56+
version: v1alpha1
57+
- description: Secret is the Schema for the secrets API
58+
displayName: Secret
59+
kind: Secret
60+
name: secrets.ecr.mobb.redhat.com
61+
version: v1alpha1
62+
description: "# ECR Secret Operator\n\nAmazon Elastic Container Registry [Private
63+
Registry Authentication](https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html)
64+
provides a temporary token that is valid only for 12 hours. It is a challenge
65+
for automatic container image build process to refresh the token or secret in
66+
a timely manner.\n\nThis operators frequently talks with AWS ECR GetAuthroization
67+
Token and create/update the secret, so that the service account can perform docker
68+
image build.\n\n\n## How to use this operator\n\n### Prerequisites\n\n* [Create
69+
an ECR private repository](https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-create.html)\n*
70+
Create An Openshift Cluster\n* Provide AWS Authentication to the operator. Two
71+
Options:\n **Note: You have to provide a secret aws-ecr-cloud-credentials in
72+
the installed namespace**\n * [IAM User](https://github.com/rh-mobb/ecr-secret-operator/tree/main/docs/iam_user.md)\n
73+
\ * [STS Assume Role](https://github.com/rh-mobb/ecr-secret-operator/tree/main/docs/iam_assume_role.md)\n\n###
74+
Install the operator\n\n### Create the ECR Secret CRD\n\n```\napiVersion: ecr.mobb.redhat.com/v1alpha1\nkind:
75+
Secret\nmetadata:\n name: ecr-secret\n namespace: test-ecr-secret-operator\nspec:\n
76+
\ generated_secret_name: ecr-docker-secret\n ecr_registry: [ACCOUNT_ID].dkr.ecr.us-east-2.amazonaws.com\n
77+
\ frequency: 10h\n region: us-east-2\n```\n\n```\noc create -f CRD_FILE\n```\n\nA
78+
docker registry secret is created by the operator momentally and the token is
79+
patched every 10 hours\n\n```\noc get secret ecr-docker-secret \nNAME TYPE
80+
\ DATA AGE\necr-docker-secret kubernetes.io/dockerconfigjson
81+
\ 1 16h\n```\n\n### A sample build process with generated secret\n\n\nLink
82+
the secret to builder\n\n```\noc secrets link builder ecr-docker-secret \n```\n\nConfigure
83+
[build config](https://github.com/rh-mobb/ecr-secret-operator/tree/main/samples/build-config.yaml)
84+
to point to your ECR Container repository\n\n```\noc create imagestream ruby\noc
85+
tag openshift/ruby:2.5-ubi8 ruby:2.5\noc create -f samples/build-config.yaml\noc
86+
start-build ruby-sample-build --wait\n```\n\nBuild should succeed and push the
87+
image to the the private ECR Container repository\n\n"
88+
displayName: ECR Secret Operator
89+
icon:
90+
- base64data: /9j/4AAQSkZJRgABAQAAAQABAAD/2wCEAAkGBwgHBgkIBwgKCgkLDRYPDQwMDRsUFRAWIB0iIiAdHx8kKDQsJCYxJx8fLT0tMTU3Ojo6Iys/RD84QzQ5OjcBCgoKDQwNGg8PGjclHyU3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3Nzc3N//AABEIAH8AfwMBIgACEQEDEQH/xAAcAAEAAgIDAQAAAAAAAAAAAAAABwgFBgEDBAL/xABEEAABAwIDBQQGBAsJAQAAAAABAAIDBBEFBiEHEjFBYRMiUaEUMkJxgZGCscHCFRYjMzRSYnKy0fAXJCVjhJKiw+EI/8QAFAEBAAAAAAAAAAAAAAAAAAAAAP/EABQRAQAAAAAAAAAAAAAAAAAAAAD/2gAMAwEAAhEDEQA/AJxREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQEREBERAREQeSXE6GGtjoZqynjq5G77IHyAPe29rgcSvWoG2+Qg5qoXPaHNfQANDuj3X+sLTMOzPmDDAG0GM18LRwZ2xe0fRdceSC1iKt9PtUzhTtAdiUM1uc1Owny3VkafbNmdlu1psLlA4/3d7SfiJCPJBP6KD2bb8Vb+cwOjd1E0jfulehu3Ke1n5ciJ6YgW/wDUgmhFXar2u5prJ5XU89NRxb53IooQ/cby7zr73U6a8gulu1bOMbHbtfBIf8ymZp8gEFj0VZDtLzfIe1/D8zQdbCGGw/4LN4Htox6j3hi1LS4hFwbd/o8oPUgEH3WQWARQq/brNbuZdhB64g4/VEvPJtxxQ/m8Eo2++WR/3QgnJFX2fbPmp9+yp8NiHK1K8kf7pLLG1O1PONSLDE2wdYYIm/WHILKLy0uJUVZNPDSVcE8tOQ2ZkUgcYyeAdbgqs4hmTHsUYWYjjFdUMd6zHTO3T9EWFvgpP/8AnuLcjxx7Rus3oWgAWFwHn7UGzbS8gy5wNHU0VZHTVlKx7AJmFzJGusbEjUWI42PHgopxDZdm+ivu4ZFVNHtUk7XeTi0+SsiiCqNVlrMFF+kYJicf+me76gVipWPidadj2OHESMsR87K4Vlrmds24ZlXDu2rrTVEgPo9ICN6U/Y0czy6mwQVba9h9UsP7rb/DQprIO9o0m26NR/79SyuYcbrMw4m/EK7c3nd2OOJu61jb8Gjw8TxPyWNtbU+4W59B0QcOO7Z/6ujtb6Hjqvs3BsbXHD7P5Lc9n2zypze91VWPkpcJYCztWDvSu4bsd9NObvgOdstiuxfH6dxOF11FXRWsO1LoZOmliD8wgjC1pAL9094Dxd/XLxC553Bs7xvxHgf60W5f2WZzdMIvwOxoDvzjqqIs8nb3jy5rU54JqaolgqIpIp4nlj43izmuHEHqPMIOouGtwRY2ILiV8mVgdbejv4G1/MrMZbxj8B4tDX+iU1XGzuywTxhzXsPIEg26Hl7lZfLlRgmNYVBiOEQUxp5RpuxNaWHm0gcCOYQVWggnndamp5JHeEUW8fK6y1JlXMtZ+j4HiTwfGBzP4gFawAAWAsOi5QVyw7ZPm+tLe2pKeiaeLqqoFx8G7ymDZ3k78TsLnpn1Iqqipl7WWRrNxos0AAC54W49VtqICIsfjuL0eBYVUYliMvZ08Dd5x5uPJo8STYAdUGLzzm6jyjhJqZx2tVLdlLTA2Mr7eTRxJ+0gKtmNYtXY9iUuI4nMZ6iY68hYcGtHJg10+u+vqzTmCszPjM+J15I3u7HEDcQsvpGPtPM+WJ4ak6273QeAQcG2t9fvHwC3jZrkGbNlV6diAfFgsTt1zmktdUuHFjDyaPad8Bre3k2dZLnzdix7YPiwumI9Jlbpfn2bT+seZ5C3iFZCjpIKGlipaSFkNPCwMjjYLBrRwACDmlpoKWnip6WJkMETQyOONoa1rRwAA4BdyIgKKtsmRhiFLJmHCoT6bC0GrjYNZox7YH6zR8wLa2ClVcEXCCnYN9QdOPTX7CtpyBnGpyhinagPlw+cgVVONSf2h+2PMaeFvbtWyl+LWPmakithleXPhAHdjd7cf3h0uOS0q4HMkcb+I5FBb2hrKevo4aujmZNTzMD45GG4c08Cu9QTsZzicLrxl/EZQKKqefRnOOkUxPq/uv8A4vep2ugIiIBNlXva3nA5ixg4bQSf4bQSFocOE0wuHP6gageOp8FYKRjZGFjhdrhYjoq8bRsgS5Tl9LoA+XBpHbrHnV1MTwY48xyDvgdbEhotuFhw9UeJ8VkcvYNVZhximwygF5pneuRcRtHrSO6AedhzC8BGuugt8gp62L5XGE4CcYqo7VmJAOYCNY4PYHx9Y+8Dkg3XL2CUeX8Ip8Mw+Pdghba54vdzc48yTqVkkRAREQEREGDznl2DNGXqrDJiGSPbvQSkX7KUatd8+PS6q3NBNS1MtNVRGGohkcySN3FjwbOargKDNuuXPQ8VpsfpWWirbQ1Fho2Zo7rvpNBH0Qgi8aAEEgjhY2Nv5hWN2V5u/GbA+xrJAcTog2Oo8ZR7MnxHHqD0Vc+rR1C2TZ5W4lh+cMPlwankqZ3u7OSBntwuI37+AGhueYCCzyIOCIC6aumgrKaWmqoWTQTNLJI5BdrmniCF3IggrE9lFZBnGipKNj5sAqZw90xNzBGO86N/vA3Qed9dQpzja1jA1gAaNABwAX0iAiIgIiICIiAsHnbA25iyviGG2HayREwk+zK3Vh+YCziIKv5NyhiubqgNoI/R6Vp/L1crTuR+IA9p3QfGysFlPKeFZWofR8Nh/KvA7apeAZJj4uPh4DgFm4omQs3ImNY0ahrRYL7QEREBERAREQEREBERAREQEREBERAREQf/2Q==
91+
mediatype: image/jpeg
92+
install:
93+
spec:
94+
clusterPermissions:
95+
- rules:
96+
- apiGroups:
97+
- ""
98+
resources:
99+
- secrets
100+
verbs:
101+
- create
102+
- delete
103+
- get
104+
- list
105+
- patch
106+
- update
107+
- watch
108+
- apiGroups:
109+
- ecr.mobb.redhat.com
110+
resources:
111+
- argohelmreposecrets
112+
verbs:
113+
- create
114+
- delete
115+
- get
116+
- list
117+
- patch
118+
- update
119+
- watch
120+
- apiGroups:
121+
- ecr.mobb.redhat.com
122+
resources:
123+
- argohelmreposecrets/finalizers
124+
verbs:
125+
- update
126+
- apiGroups:
127+
- ecr.mobb.redhat.com
128+
resources:
129+
- argohelmreposecrets/status
130+
verbs:
131+
- get
132+
- patch
133+
- update
134+
- apiGroups:
135+
- ecr.mobb.redhat.com
136+
resources:
137+
- secrets
138+
verbs:
139+
- create
140+
- delete
141+
- get
142+
- list
143+
- patch
144+
- update
145+
- watch
146+
- apiGroups:
147+
- ecr.mobb.redhat.com
148+
resources:
149+
- secrets/finalizers
150+
verbs:
151+
- update
152+
- apiGroups:
153+
- ecr.mobb.redhat.com
154+
resources:
155+
- secrets/status
156+
verbs:
157+
- get
158+
- patch
159+
- update
160+
- apiGroups:
161+
- authentication.k8s.io
162+
resources:
163+
- tokenreviews
164+
verbs:
165+
- create
166+
- apiGroups:
167+
- authorization.k8s.io
168+
resources:
169+
- subjectaccessreviews
170+
verbs:
171+
- create
172+
serviceAccountName: ecr-secret-operator-controller-manager
173+
deployments:
174+
- label:
175+
control-plane: controller-manager
176+
name: ecr-secret-operator-controller-manager
177+
spec:
178+
replicas: 1
179+
selector:
180+
matchLabels:
181+
control-plane: controller-manager
182+
strategy: {}
183+
template:
184+
metadata:
185+
annotations:
186+
kubectl.kubernetes.io/default-container: manager
187+
labels:
188+
control-plane: controller-manager
189+
spec:
190+
containers:
191+
- args:
192+
- --secure-listen-address=0.0.0.0:8443
193+
- --upstream=http://127.0.0.1:8080/
194+
- --logtostderr=true
195+
- --v=0
196+
image: gcr.io/kubebuilder/kube-rbac-proxy:v0.8.0
197+
name: kube-rbac-proxy
198+
ports:
199+
- containerPort: 8443
200+
name: https
201+
protocol: TCP
202+
resources:
203+
limits:
204+
cpu: 500m
205+
memory: 128Mi
206+
requests:
207+
cpu: 5m
208+
memory: 64Mi
209+
- args:
210+
- --health-probe-bind-address=:8081
211+
- --metrics-bind-address=127.0.0.1:8080
212+
- --leader-elect
213+
command:
214+
- /manager
215+
env:
216+
- name: AWS_ACCESS_KEY_ID
217+
valueFrom:
218+
secretKeyRef:
219+
key: aws_access_key_id
220+
name: aws-ecr-cloud-credentials
221+
optional: true
222+
- name: AWS_SECRET_ACCESS_KEY
223+
valueFrom:
224+
secretKeyRef:
225+
key: aws_secret_access_key
226+
name: aws-ecr-cloud-credentials
227+
optional: true
228+
- name: AWS_SDK_LOAD_CONFIG
229+
value: "1"
230+
- name: AWS_CONFIG_FILE
231+
value: /var/run/secrets/aws/credentials
232+
- name: WATCH_NAMESPACE
233+
valueFrom:
234+
fieldRef:
235+
fieldPath: metadata.annotations['olm.targetNamespaces']
236+
image: quay.io/mobb/ecr-secret-operator:v0.4.1
237+
livenessProbe:
238+
httpGet:
239+
path: /healthz
240+
port: 8081
241+
initialDelaySeconds: 15
242+
periodSeconds: 20
243+
name: manager
244+
readinessProbe:
245+
httpGet:
246+
path: /readyz
247+
port: 8081
248+
initialDelaySeconds: 5
249+
periodSeconds: 10
250+
resources:
251+
limits:
252+
cpu: 500m
253+
memory: 1000Mi
254+
requests:
255+
cpu: 10m
256+
memory: 64Mi
257+
securityContext:
258+
allowPrivilegeEscalation: false
259+
volumeMounts:
260+
- mountPath: /var/run/secrets/aws
261+
name: aws-credentials
262+
readOnly: true
263+
- mountPath: /var/run/secrets/openshift/serviceaccount
264+
name: bound-sa-token
265+
readOnly: true
266+
securityContext:
267+
runAsNonRoot: true
268+
serviceAccountName: ecr-secret-operator-controller-manager
269+
terminationGracePeriodSeconds: 10
270+
volumes:
271+
- name: aws-credentials
272+
secret:
273+
optional: true
274+
secretName: aws-ecr-cloud-credentials
275+
- name: bound-sa-token
276+
projected:
277+
sources:
278+
- serviceAccountToken:
279+
audience: openshift
280+
path: token
281+
permissions:
282+
- rules:
283+
- apiGroups:
284+
- ""
285+
resources:
286+
- configmaps
287+
verbs:
288+
- get
289+
- list
290+
- watch
291+
- create
292+
- update
293+
- patch
294+
- delete
295+
- apiGroups:
296+
- coordination.k8s.io
297+
resources:
298+
- leases
299+
verbs:
300+
- get
301+
- list
302+
- watch
303+
- create
304+
- update
305+
- patch
306+
- delete
307+
- apiGroups:
308+
- ""
309+
resources:
310+
- events
311+
verbs:
312+
- create
313+
- patch
314+
serviceAccountName: ecr-secret-operator-controller-manager
315+
strategy: deployment
316+
installModes:
317+
- supported: true
318+
type: OwnNamespace
319+
- supported: true
320+
type: SingleNamespace
321+
- supported: true
322+
type: MultiNamespace
323+
- supported: true
324+
type: AllNamespaces
325+
keywords:
326+
- ecr
327+
- aws
328+
- redhat
329+
links:
330+
- name: Ecr Secret Operator
331+
url: https://github.com/rh-mobb/ecr-secret-operator
332+
maintainers:
333+
- email: [email protected]
334+
name: Shaozhen Ding
335+
maturity: alpha
336+
provider:
337+
name: Managed Openshift Black Belt
338+
replaces: ecr-secret-operator.v0.4.0
339+
version: 0.4.1

‎operators/ecr-secret-operator/0.4.1/ecr-secret-sample_ecr.mobb.redhat.com_v1alpha1_secret.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: ecr.mobb.redhat.com/v1alpha1
2+
kind: Secret
3+
metadata:
4+
name: ecr-secret-sample
5+
spec:
6+
ecr_registry: ACCOUNT_ID.dkr.ecr.us-east-2.amazonaws.com
7+
frequency: 10h
8+
generated_secret_name: ecr-docker-secret
9+
region: us-east-2

0 commit comments

Comments
 (0)