kfox1111
2a8c1b63c4
* Bottom turtle ha registry tests Signed-off-by: Kevin Fox <[email protected]> * Fix test because of spire-ha-agent Signed-off-by: Kevin Fox <[email protected]> * Fix config options Signed-off-by: Kevin Fox <[email protected]> * Fix yq issue and log better Signed-off-by: Kevin Fox <[email protected]> * Fix some things Signed-off-by: Kevin Fox <[email protected]> * Change timeout and fix image Signed-off-by: Kevin Fox <[email protected]> * Bump up zot version. Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More debugging stuff Signed-off-by: Kevin Fox <[email protected]> * More fixes Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * More logging Signed-off-by: Kevin Fox <[email protected]> * Fix test Signed-off-by: Kevin Fox <[email protected]> * Log less Signed-off-by: Kevin Fox <[email protected]> * Cleanup Signed-off-by: Kevin Fox <[email protected]> * Make test less different then real deployment Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
26 lines
926 B
YAML
26 lines
926 B
YAML
apiVersion: kubelet.config.k8s.io/v1
|
|
kind: CredentialProviderConfig
|
|
providers:
|
|
- name: k8s-image-cred-spire-identity-exchange
|
|
matchImages:
|
|
- "zot.production.other"
|
|
defaultCacheDuration: "0s"
|
|
apiVersion: credentialprovider.kubelet.k8s.io/v1
|
|
args:
|
|
- "--username=zot"
|
|
- "--mode=spire-identity-exchange"
|
|
- "--url=https://spire-identity-exchange-rest-spiffe.production.other"
|
|
- "--stack=image_pull"
|
|
- "--registry-audience=zot"
|
|
- "--spiffe-audience=spire-identity-exchange"
|
|
- "--spiffe-hint=image-pull"
|
|
- "--spiffe-id=spiffe://production.other/service/spire-identity-exchange"
|
|
- "--timeout=10s"
|
|
env:
|
|
- name: SPIFFE_ENDPOINT_SOCKET
|
|
value: unix:///var/run/spire/agent/sockets/main/public/api.sock
|
|
tokenAttributes:
|
|
serviceAccountTokenAudience: "spire-identity-exchange"
|
|
cacheType: "Token"
|
|
requireServiceAccount: true
|