Bottom turtle ha registry tests (#929)

* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2026-09-04 12:50:34 -07:00
parent bb4c73febf
commit 2a8c1b63c4
23 changed files with 1082 additions and 28 deletions
@@ -0,0 +1,25 @@
+apiVersion: kubelet.config.k8s.io/v1
+kind: CredentialProviderConfig
+providers:
+  - name: k8s-image-cred-spire-identity-exchange
+    matchImages:
+      - "zot.production.other"
+    defaultCacheDuration: "0s"
+    apiVersion: credentialprovider.kubelet.k8s.io/v1
+    args:
+      - "--username=zot"
+      - "--mode=spire-identity-exchange"
+      - "--url=https://spire-identity-exchange-rest-spiffe.production.other"
+      - "--stack=image_pull"
+      - "--registry-audience=zot"
+      - "--spiffe-audience=spire-identity-exchange"
+      - "--spiffe-hint=image-pull"
+      - "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
+      - "--timeout=10s"
+    env:
+      - name: SPIFFE_ENDPOINT_SOCKET
+        value: unix:///var/run/spire/agent/sockets/main/public/api.sock
+    tokenAttributes:
+      serviceAccountTokenAudience: "spire-identity-exchange"
+      cacheType: "Token"
+      requireServiceAccount: true