diff --git a/core-services/ci-secret-bootstrap/_config.yaml b/core-services/ci-secret-bootstrap/_config.yaml index 38803dc86b084..dec2b8e0e2661 100644 --- a/core-services/ci-secret-bootstrap/_config.yaml +++ b/core-services/ci-secret-bootstrap/_config.yaml @@ -19,6 +19,7 @@ cluster_groups: - build13 - core-ci - vsphere02 + - hvidosil managed_clusters: - app.ci - build01 @@ -37,6 +38,7 @@ cluster_groups: - core-ci - hosted-mgmt - hosted-mgmt2 + - hvidosil non_app_ci: - build01 - build02 @@ -53,6 +55,7 @@ cluster_groups: - build13 - core-ci - vsphere02 + - hvidosil openshift_config_pull_secret: - build01 - build02 @@ -71,6 +74,7 @@ cluster_groups: - hosted-mgmt - hosted-mgmt2 - vsphere02 + - hvidosil secret_configs: - from: ops-mirror.pem: @@ -930,6 +934,9 @@ secret_configs: - auth_field: token_image-puller_build13_reg_auth_value.txt item: build_farm registry_url: registry.build13.ci.openshift.org + - auth_field: token_image-puller_hvidosil_reg_auth_value.txt + item: build_farm + registry_url: registry.hvidosil.ci.openshift.org - auth_field: auth email_field: email item: cloud.openshift.com-pull-secret @@ -2113,6 +2120,9 @@ secret_configs: - auth_field: token_image-puller_build13_reg_auth_value.txt item: build_farm registry_url: registry.build13.ci.openshift.org + - auth_field: token_image-puller_hvidosil_reg_auth_value.txt + item: build_farm + registry_url: registry.hvidosil.ci.openshift.org - auth_field: auth email_field: email item: cloud.openshift.com-pull-secret @@ -2280,6 +2290,9 @@ secret_configs: - auth_field: token_image-puller_build13_reg_auth_value.txt item: build_farm registry_url: registry.build13.ci.openshift.org + - auth_field: token_image-puller_hvidosil_reg_auth_value.txt + item: build_farm + registry_url: registry.hvidosil.ci.openshift.org to: - cluster_groups: - non_app_ci @@ -2707,6 +2720,9 @@ secret_configs: build13.config: field: sa.pod-scaler.build13.config item: pod-scaler + hvidosil.config: + field: sa.pod-scaler.hvidosil.config + item: pod-scaler core-ci.config: field: sa.pod-scaler.core-ci.config item: pod-scaler @@ -2752,6 +2768,9 @@ secret_configs: sa.pod-scaler.build13.token.txt: field: sa.pod-scaler.build13.token.txt item: pod-scaler + sa.pod-scaler.hvidosil.token.txt: + field: sa.pod-scaler.hvidosil.token.txt + item: pod-scaler sa.pod-scaler.core-ci.token.txt: field: sa.pod-scaler.core-ci.token.txt item: pod-scaler @@ -2805,6 +2824,9 @@ secret_configs: build13.config: field: sa.component-monitor.build13.config item: ship-status-dash-component-monitor + hvidosil.config: + field: sa.component-monitor.hvidosil.config + item: ship-status-dash-component-monitor core-ci.config: field: sa.component-monitor.core-ci.config item: ship-status-dash-component-monitor @@ -2853,6 +2875,9 @@ secret_configs: sa.component-monitor.build13.token.txt: field: sa.component-monitor.build13.token.txt item: ship-status-dash-component-monitor + sa.component-monitor.hvidosil.token.txt: + field: sa.component-monitor.hvidosil.token.txt + item: ship-status-dash-component-monitor sa.component-monitor.core-ci.token.txt: field: sa.component-monitor.core-ci.token.txt item: ship-status-dash-component-monitor @@ -3137,6 +3162,12 @@ secret_configs: sa.crier.build13.token.txt: field: sa.crier.build13.token.txt item: build_farm + sa.crier.hvidosil.config: + field: sa.crier.hvidosil.config + item: build_farm + sa.crier.hvidosil.token.txt: + field: sa.crier.hvidosil.token.txt + item: build_farm sa.crier.core-ci.config: field: sa.crier.core-ci.config item: build_farm @@ -3199,6 +3230,9 @@ secret_configs: sa.config-updater.build13.config: field: sa.config-updater.build13.config item: config-updater + sa.config-updater.hvidosil.config: + field: sa.config-updater.hvidosil.config + item: config-updater sa.config-updater.core-ci.config: field: sa.config-updater.core-ci.config item: config-updater @@ -3309,6 +3343,12 @@ secret_configs: sa.deck.build13.token.txt: field: sa.deck.build13.token.txt item: build_farm + sa.deck.hvidosil.config: + field: sa.deck.hvidosil.config + item: build_farm + sa.deck.hvidosil.token.txt: + field: sa.deck.hvidosil.token.txt + item: build_farm sa.deck.core-ci.config: field: sa.deck.core-ci.config item: build_farm @@ -3413,6 +3453,12 @@ secret_configs: sa.hook.build13.token.txt: field: sa.hook.build13.token.txt item: build_farm + sa.hook.hvidosil.config: + field: sa.hook.hvidosil.config + item: build_farm + sa.hook.hvidosil.token.txt: + field: sa.hook.hvidosil.token.txt + item: build_farm sa.hook.core-ci.config: field: sa.hook.core-ci.config item: build_farm @@ -3517,6 +3563,12 @@ secret_configs: sa.prow-controller-manager.build13.token.txt: field: sa.prow-controller-manager.build13.token.txt item: build_farm + sa.prow-controller-manager.hvidosil.config: + field: sa.prow-controller-manager.hvidosil.config + item: build_farm + sa.prow-controller-manager.hvidosil.token.txt: + field: sa.prow-controller-manager.hvidosil.token.txt + item: build_farm sa.prow-controller-manager.core-ci.config: field: sa.prow-controller-manager.core-ci.config item: build_farm @@ -3653,6 +3705,12 @@ secret_configs: sa.sinker.build13.token.txt: field: sa.sinker.build13.token.txt item: build_farm + sa.sinker.hvidosil.config: + field: sa.sinker.hvidosil.config + item: build_farm + sa.sinker.hvidosil.token.txt: + field: sa.sinker.hvidosil.token.txt + item: build_farm sa.sinker.core-ci.config: field: sa.sinker.core-ci.config item: build_farm @@ -3751,6 +3809,12 @@ secret_configs: sa.dptp-controller-manager.build13.token.txt: field: sa.dptp-controller-manager.build13.token.txt item: build_farm + sa.dptp-controller-manager.hvidosil.config: + field: sa.dptp-controller-manager.hvidosil.config + item: build_farm + sa.dptp-controller-manager.hvidosil.token.txt: + field: sa.dptp-controller-manager.hvidosil.token.txt + item: build_farm sa.dptp-controller-manager.core-ci.config: field: sa.dptp-controller-manager.core-ci.config item: build_farm @@ -3849,6 +3913,12 @@ secret_configs: sa.promoted-image-governor.build13.token.txt: field: sa.promoted-image-governor.build13.token.txt item: build_farm + sa.promoted-image-governor.hvidosil.config: + field: sa.promoted-image-governor.hvidosil.config + item: build_farm + sa.promoted-image-governor.hvidosil.token.txt: + field: sa.promoted-image-governor.hvidosil.token.txt + item: build_farm sa.promoted-image-governor.core-ci.config: field: sa.promoted-image-governor.core-ci.config item: build_farm @@ -3981,6 +4051,12 @@ secret_configs: sa.ci-chat-bot.build13.token.txt: field: sa.ci-chat-bot.build13.token.txt item: ci-chat-bot + sa.ci-chat-bot.hvidosil.config: + field: sa.ci-chat-bot.hvidosil.config + item: ci-chat-bot + sa.ci-chat-bot.hvidosil.token.txt: + field: sa.ci-chat-bot.hvidosil.token.txt + item: ci-chat-bot sa.ci-chat-bot.core-ci.config: field: sa.ci-chat-bot.core-ci.config item: ci-chat-bot @@ -4091,6 +4167,12 @@ secret_configs: sa.github-ldap-user-group-creator.build13.token.txt: field: sa.github-ldap-user-group-creator.build13.token.txt item: build_farm + sa.github-ldap-user-group-creator.hvidosil.config: + field: sa.github-ldap-user-group-creator.hvidosil.config + item: build_farm + sa.github-ldap-user-group-creator.hvidosil.token.txt: + field: sa.github-ldap-user-group-creator.hvidosil.token.txt + item: build_farm sa.github-ldap-user-group-creator.core-ci.config: field: sa.github-ldap-user-group-creator.core-ci.config item: build_farm @@ -5081,6 +5163,12 @@ secret_configs: sa.cluster-display.build13.token.txt: field: sa.cluster-display.build13.token.txt item: build_farm + sa.cluster-display.hvidosil.config: + field: sa.cluster-display.hvidosil.config + item: build_farm + sa.cluster-display.hvidosil.token.txt: + field: sa.cluster-display.hvidosil.token.txt + item: build_farm sa.cluster-display.core-ci.config: field: sa.cluster-display.core-ci.config item: build_farm @@ -6229,6 +6317,20 @@ secret_configs: - cluster: build13 name: thanos-remote-write-tls namespace: openshift-monitoring +- from: + ca.crt: + field: ca.crt + item: ci-monitoring-thanos-tls + client.crt: + field: client.hvidosil.crt + item: ci-monitoring-thanos-tls + client.key: + field: client.hvidosil.key + item: ci-monitoring-thanos-tls + to: + - cluster: hvidosil + name: thanos-remote-write-tls + namespace: openshift-monitoring - from: ca.crt: field: ca.crt @@ -6315,6 +6417,34 @@ secret_configs: - cluster: build13 name: dex-rh-sso namespace: openshift-config +- from: + hvidosil-id: + field: hvidosil-id + item: dex + hvidosil-secret: + field: hvidosil-secret + item: dex + to: + - cluster: app.ci + name: hvidosil-secret + namespace: dex + - cluster: core-ci + name: hvidosil-secret + namespace: dex + - cluster: app.ci + name: hvidosil-dex-oidc + namespace: ci + - cluster: core-ci + name: hvidosil-dex-oidc + namespace: ci +- from: + clientSecret: + field: hvidosil-secret + item: dex + to: + - cluster: hvidosil + name: dex-rh-sso + namespace: openshift-config - from: clientSecret: field: token @@ -6410,6 +6540,14 @@ secret_configs: - cluster: build12 name: aws-sts-cluster-config namespace: ci +- from: + home_role_arn: + field: hvidosil + item: aws-sts-cluster-config + to: + - cluster: hvidosil + name: aws-sts-cluster-config + namespace: ci user_secrets_target_clusters: - app.ci - build01 @@ -6425,6 +6563,7 @@ user_secrets_target_clusters: - build11 - build12 - build13 +- hvidosil - core-ci - hosted-mgmt - hosted-mgmt2 diff --git a/core-services/ci-secret-bootstrap/gsm-config.yaml b/core-services/ci-secret-bootstrap/gsm-config.yaml index 62f406760ccd6..2b0892ab4fcf3 100644 --- a/core-services/ci-secret-bootstrap/gsm-config.yaml +++ b/core-services/ci-secret-bootstrap/gsm-config.yaml @@ -20,6 +20,7 @@ cluster_groups: - build13 - core-ci - vsphere02 + - hvidosil managed_clusters: - app.ci - build01 @@ -38,6 +39,7 @@ cluster_groups: - core-ci - hosted-mgmt - hosted-mgmt2 + - hvidosil non_app_ci: - build01 - build02 @@ -54,6 +56,7 @@ cluster_groups: - build13 - core-ci - vsphere02 + - hvidosil standard_build_clusters: - build01 - build02 @@ -68,6 +71,7 @@ cluster_groups: - build11 - build12 - build13 + - hvidosil user_secrets_target_clusters: - app.ci - build01 @@ -87,6 +91,7 @@ cluster_groups: - hosted-mgmt - hosted-mgmt2 - vsphere02 + - hvidosil dptp_collection: test-platform-infra @@ -155,6 +160,9 @@ bundles: - sa--dot--cluster-init--dot--build12--dot--token--dot--txt - sa--dot--cluster-init--dot--build13--dot--config - sa--dot--cluster-init--dot--build13--dot--token--dot--txt + - sa--dot--cluster-init--dot--hvidosil--dot--config + - sa--dot--cluster-init--dot--hvidosil--dot--token--dot--txt + - sa--dot--cluster-init--dot--core-ci--dot--config - sa--dot--cluster-init--dot--core-ci--dot--config - sa--dot--cluster-init--dot--core-ci--dot--token--dot--txt - sa--dot--cluster-init--dot--vsphere02--dot--config @@ -776,6 +784,52 @@ bundles: namespace: ocp type: kubernetes.io/dockerconfigjson + - name: registry-pull-credentials + dockerconfig: + registries: + - auth_field: token_image-puller_hvidosil_reg_auth_value--dot--txt + group: build_farm + registry_url: image-registry.openshift-image-registry.svc.cluster.local:5000 + - auth_field: token_image-puller_hvidosil_reg_auth_value--dot--txt + group: build_farm + registry_url: image-registry.openshift-image-registry.svc:5000 + - auth_field: token_image-puller_hvidosil_reg_auth_value--dot--txt + group: build_farm + registry_url: registry.hvidosil.ci.openshift.org + - auth_field: token_image-puller_app--dot--ci_reg_auth_value--dot--txt + group: build_farm + registry_url: registry.ci.openshift.org + - auth_field: auth + email_field: email + group: quay--dot--io-pull-secret + registry_url: quay.io + - auth_field: auth + group: quayio-ci-read-only-robot + registry_url: quay-proxy.ci.openshift.org + - auth_field: auth + group: quayio-ci-read-only-robot + registry_url: quay.io/openshift/ci + - auth_field: auth + group: quayio-ci-read-only-robot + registry_url: quay.io/openshift/network-edge-testing + - auth_field: auth + group: quayio-ci-read-only-robot + registry_url: qci-pull-through-cache-us-east-1-ci.apps.ci.l2s4.p1.openshiftapps.com + sync_to_cluster: true + targets: + - cluster: hvidosil + namespace: ci + type: kubernetes.io/dockerconfigjson + - cluster: hvidosil + namespace: test-credentials + type: kubernetes.io/dockerconfigjson + - cluster: hvidosil + namespace: keel + type: kubernetes.io/dockerconfigjson + - cluster: hvidosil + namespace: ocp + type: kubernetes.io/dockerconfigjson + - name: registry-pull-credentials dockerconfig: registries: @@ -1668,6 +1722,24 @@ bundles: namespace: test-credentials type: kubernetes.io/dockerconfigjson + - name: manifest-tool-local-pusher + dockerconfig: + registries: + - auth_field: token_image-pusher_hvidosil_reg_auth_value--dot--txt + group: build_farm + registry_url: image-registry.openshift-image-registry.svc:5000 + - auth_field: token_image-pusher_hvidosil_reg_auth_value--dot--txt + group: build_farm + registry_url: registry.hvidosil.ci.openshift.org + sync_to_cluster: true + targets: + - cluster: hvidosil + namespace: ci + type: kubernetes.io/dockerconfigjson + - cluster: hvidosil + namespace: test-credentials + type: kubernetes.io/dockerconfigjson + - name: manifest-tool-local-pusher dockerconfig: registries: diff --git a/core-services/ci-secret-generator/_config.yaml b/core-services/ci-secret-generator/_config.yaml index 45dfda4577083..98c51444602da 100644 --- a/core-services/ci-secret-generator/_config.yaml +++ b/core-services/ci-secret-generator/_config.yaml @@ -24,6 +24,7 @@ - build13 - core-ci - vsphere02 + - hvidosil service_account: - deck - sinker @@ -122,6 +123,7 @@ - build13 - core-ci - vsphere02 + - hvidosil service_account: - image-puller - image-pusher @@ -151,6 +153,7 @@ - build13 - core-ci - vsphere02 + - hvidosil service_account: - ci-chat-bot - fields: @@ -179,6 +182,7 @@ - build12 - build13 - core-ci + - hvidosil service_account: - pod-scaler - fields: @@ -208,6 +212,7 @@ - build13 - core-ci - hosted-mgmt + - hvidosil service_account: - component-monitor - fields: @@ -338,6 +343,7 @@ - build12 - build13 - core-ci + - hvidosil - fields: - cmd: oc --kubeconfig /tmp/build-farm-credentials/sa.config-updater.$(cluster).config create token -n rosa-cluster-lease rosa-cluster-lease-manager --duration=2419200s