CH-240: Implements support for authentication using service accounts for Docker registries hosted on Google Artifact Registry.

deployment-configuration/codefresh-template-dev.yaml

@@ -35,7 +35,7 @@ steps:
     commands:
       - bash cloud-harness/install.sh
       - export HELM_META_ARGS="$( [ -n "${{HARNESS_CHART_NAME}}" ] && printf -- "--name %s " "${{HARNESS_CHART_NAME}}"; [ -n "${{HARNESS_CHART_VERSION}}" ] && printf -- "--chart-version %s " "${{HARNESS_CHART_VERSION}}"; [ -n "${{HARNESS_APP_VERSION}}" ] && printf -- "--app-version %s" "${{HARNESS_APP_VERSION}}" )"
-      - harness-deployment $PATHS -d ${{DOMAIN}} -r ${{REGISTRY}} -rs '${{REGISTRY_SECRET}}' -n ${{NAMESPACE}} --write-env -e $ENV --cache-url '${{IMAGE_CACHE_URL}}' $HELM_META_ARGS $PARAMS
+      - harness-deployment $PATHS -d ${{DOMAIN}} -r ${{REGISTRY}} -rsn '${{REGISTRY_SECRET}}' -n ${{NAMESPACE}} --write-env -e $ENV --cache-url '${{IMAGE_CACHE_URL}}' $HELM_META_ARGS $PARAMS
       - cat deployment/.env >> ${{CF_VOLUME_PATH}}/env_vars_to_export
       - cat ${{CF_VOLUME_PATH}}/env_vars_to_export
   prepare_deployment_view:

deployment-configuration/codefresh-template-prod.yaml

@@ -31,7 +31,7 @@ steps:
     commands:
       - bash cloud-harness/install.sh
       - export HELM_META_ARGS="$( [ -n "${{HARNESS_CHART_NAME}}" ] && printf -- "--name %s " "${{HARNESS_CHART_NAME}}"; [ -n "${{HARNESS_CHART_VERSION}}" ] && printf -- "--chart-version %s " "${{HARNESS_CHART_VERSION}}"; [ -n "${{HARNESS_APP_VERSION}}" ] && printf -- "--app-version %s" "${{HARNESS_APP_VERSION}}" )"
-      - harness-deployment $PATHS -t ${{DEPLOYMENT_TAG}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rs '${{REGISTRY_SECRET}}' -n ${{NAMESPACE}} -e $ENV --no-cd $HELM_META_ARGS $PARAMS
+      - harness-deployment $PATHS -t ${{DEPLOYMENT_TAG}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rsn '${{REGISTRY_SECRET}}' -n ${{NAMESPACE}} -e $ENV --no-cd $HELM_META_ARGS $PARAMS
   prepare_deployment_view:
     commands:
       - "helm template ./deployment/helm --debug -n ${{NAMESPACE}}"

deployment-configuration/codefresh-template-stage.yaml

@@ -34,7 +34,7 @@ steps:
     commands:
       - bash cloud-harness/install.sh
       - export HELM_META_ARGS="$( [ -n "${{HARNESS_CHART_NAME}}" ] && printf -- "--name %s " "${{HARNESS_CHART_NAME}}"; [ -n "${{HARNESS_CHART_VERSION}}" ] && printf -- "--chart-version %s " "${{HARNESS_CHART_VERSION}}"; [ -n "${{HARNESS_APP_VERSION}}" ] && printf -- "--app-version %s" "${{HARNESS_APP_VERSION}}" )"
-      - harness-deployment $PATHS -t ${{DEPLOYMENT_TAG}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rs ${{REGISTRY_SECRET}} -n ${{NAMESPACE}} -e $ENV --no-cd $HELM_META_ARGS $PARAMS
+      - harness-deployment $PATHS -t ${{DEPLOYMENT_TAG}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rsn ${{REGISTRY_SECRET}} -n ${{NAMESPACE}} -e $ENV --no-cd $HELM_META_ARGS $PARAMS
   prepare_deployment_view:
     commands:
       - "helm template ./deployment/helm --debug -n ${{NAMESPACE}}"

deployment-configuration/codefresh-template-test.yaml

@@ -34,7 +34,7 @@ steps:
     commands:
       - bash cloud-harness/install.sh
       - export HELM_META_ARGS="$( [ -n "${{HARNESS_CHART_NAME}}" ] && printf -- "--name %s " "${{HARNESS_CHART_NAME}}"; [ -n "${{HARNESS_CHART_VERSION}}" ] && printf -- "--chart-version %s " "${{HARNESS_CHART_VERSION}}"; [ -n "${{HARNESS_APP_VERSION}}" ] && printf -- "--app-version %s" "${{HARNESS_APP_VERSION}}" )"
-      - harness-deployment $PATHS -n test-${{NAMESPACE_BASENAME}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rs ${{REGISTRY_SECRET}} -e $ENV --write-env --cache-url '${{IMAGE_CACHE_URL}}' -N $HELM_META_ARGS $PARAMS
+      - harness-deployment $PATHS -n test-${{NAMESPACE_BASENAME}} -d ${{DOMAIN}} -r ${{REGISTRY}} -rsn ${{REGISTRY_SECRET}} -e $ENV --write-env --cache-url '${{IMAGE_CACHE_URL}}' -N $HELM_META_ARGS $PARAMS
       - cat deployment/.env >> ${{CF_VOLUME_PATH}}/env_vars_to_export
       - cat ${{CF_VOLUME_PATH}}/env_vars_to_export
   prepare_deployment_view:

deployment-configuration/helm/templates/auto-deployments.yaml

@@ -32,7 +32,7 @@ spec:
     spec:
       {{- if and .root.Values.registry.secret (contains .root.Values.registry.name .app.harness.deployment.image) }}
       imagePullSecrets:
-      - name: {{ .root.Values.registry.secret }}
+      - name: {{ .root.Values.registry.secret.name }}
       {{- end }}
       {{- if and .app.harness.deployment.volume }}
       {{- if or (not (hasKey .app.harness.deployment.volume "usenfs")) (not .app.harness.deployment.volume.usenfs) }}

deployment-configuration/helm/templates/configmap.yaml

@@ -10,6 +10,13 @@ metadata:
 data:
   allvalues.yaml: |
 {{- $values_copy := deepCopy .Values }}
+{{- $registry := get $values_copy "registry" }}
+{{- if $registry }}
+  {{- $secret := get $registry "secret" }}
+  {{- if and (kindIs "map" $secret) (not (empty $secret.value)) }}
+    {{- $tmp := set $registry "secret" nil }}
+  {{- end }}
+{{- end }}
 {{- range $key, $val := .Values.apps }}
   {{- $app := get $values_copy.apps $key }}
   {{- $tmp := set $app.harness "secrets" dict }}

deployment-configuration/helm/templates/registry-secret.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.registry.name .Values.registry.secret.name }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.registry.secret.name | quote }}
+  namespace: {{ .Release.Namespace }}
+type: kubernetes.io/dockerconfigjson
+stringData:
+  .dockerconfigjson: |-
+    {
+      "auths": {
+        "{{ .Values.registry.name }}": {
+          "username": "_json_key",
+          "password": {{ .Values.registry.secret.value | toJson }},
+          "auth": "{{ printf "_json_key:%s" .Values.registry.secret.value | b64enc }}"
+        }
+      }
+    }
+{{- end }}

deployment-configuration/helm/values.yaml

@@ -13,6 +13,10 @@ registry:
   name: "localhost:5000"
   # -- Optional secret used for pulling from docker registry.
   secret:
+    # -- Secret name used for pulling from docker registry.
+    name:
+    # -- Value of the secret used for pulling from docker registry in json encoded format.
+    value:
 # -- Docker tag used to pull images.
 tag: latest
 # -- List of applications.
@@ -85,4 +89,4 @@ proxy:
       requests:
         memory: "32Mi"
       limits:
-        memory: "64Mi"
+        memory: "64Mi"