Bottom turtle ha registry tests (#929)

* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2026-09-04 12:50:34 -07:00
parent bb4c73febf
commit 2a8c1b63c4
23 changed files with 1082 additions and 28 deletions
@@ -0,0 +1,34 @@
+# Pulls the image zot only serves to an exchange-minted identity.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zot-pull
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: image-pull
+spec:
+  backoffLimit: 0
+  template:
+    metadata:
+      labels:
+        app: image-pull
+    spec:
+      serviceAccountName: zot-pull
+      restartPolicy: Never
+      containers:
+      - name: main
+        image: zot.production.other/test/busybox:latest
+        imagePullPolicy: Always
+        command: ["sh", "-c", "echo IMAGE-PULL-OK"]
+      # The node authorizer only lets kubelet mint a service account token for an audience
+      # that appears in the pod spec. This must be here to work, even if it looks unused.
+      volumes:
+      - name: spire-token-gate
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: spire-identity-exchange
+              expirationSeconds: 3600