Secrets example for onboarding a cluster

core-services/ci-secret-bootstrap/_config.yaml

@@ -19,6 +19,7 @@ cluster_groups:
   - build13
   - core-ci
   - vsphere02
+  - hvidosil
   managed_clusters:
   - app.ci
   - build01
@@ -37,6 +38,7 @@ cluster_groups:
   - core-ci
   - hosted-mgmt
   - hosted-mgmt2
+  - hvidosil
   non_app_ci:
   - build01
   - build02
@@ -53,6 +55,7 @@ cluster_groups:
   - build13
   - core-ci
   - vsphere02
+  - hvidosil
   openshift_config_pull_secret:
   - build01
   - build02
@@ -71,6 +74,7 @@ cluster_groups:
   - hosted-mgmt
   - hosted-mgmt2
   - vsphere02
+  - hvidosil
 secret_configs:
 - from:
     ops-mirror.pem:
@@ -930,6 +934,9 @@ secret_configs:
       - auth_field: token_image-puller_build13_reg_auth_value.txt
         item: build_farm
         registry_url: registry.build13.ci.openshift.org
+      - auth_field: token_image-puller_hvidosil_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.hvidosil.ci.openshift.org
       - auth_field: auth
         email_field: email
         item: cloud.openshift.com-pull-secret
@@ -2113,6 +2120,9 @@ secret_configs:
       - auth_field: token_image-puller_build13_reg_auth_value.txt
         item: build_farm
         registry_url: registry.build13.ci.openshift.org
+      - auth_field: token_image-puller_hvidosil_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.hvidosil.ci.openshift.org
       - auth_field: auth
         email_field: email
         item: cloud.openshift.com-pull-secret
@@ -2280,6 +2290,9 @@ secret_configs:
       - auth_field: token_image-puller_build13_reg_auth_value.txt
         item: build_farm
         registry_url: registry.build13.ci.openshift.org
+      - auth_field: token_image-puller_hvidosil_reg_auth_value.txt
+        item: build_farm
+        registry_url: registry.hvidosil.ci.openshift.org
   to:
   - cluster_groups:
     - non_app_ci
@@ -2707,6 +2720,9 @@ secret_configs:
     build13.config:
       field: sa.pod-scaler.build13.config
       item: pod-scaler
+    hvidosil.config:
+      field: sa.pod-scaler.hvidosil.config
+      item: pod-scaler
     core-ci.config:
       field: sa.pod-scaler.core-ci.config
       item: pod-scaler
@@ -2752,6 +2768,9 @@ secret_configs:
     sa.pod-scaler.build13.token.txt:
       field: sa.pod-scaler.build13.token.txt
       item: pod-scaler
+    sa.pod-scaler.hvidosil.token.txt:
+      field: sa.pod-scaler.hvidosil.token.txt
+      item: pod-scaler
     sa.pod-scaler.core-ci.token.txt:
       field: sa.pod-scaler.core-ci.token.txt
       item: pod-scaler
@@ -2805,6 +2824,9 @@ secret_configs:
     build13.config:
       field: sa.component-monitor.build13.config
       item: ship-status-dash-component-monitor
+    hvidosil.config:
+      field: sa.component-monitor.hvidosil.config
+      item: ship-status-dash-component-monitor
     core-ci.config:
       field: sa.component-monitor.core-ci.config
       item: ship-status-dash-component-monitor
@@ -2853,6 +2875,9 @@ secret_configs:
     sa.component-monitor.build13.token.txt:
       field: sa.component-monitor.build13.token.txt
       item: ship-status-dash-component-monitor
+    sa.component-monitor.hvidosil.token.txt:
+      field: sa.component-monitor.hvidosil.token.txt
+      item: ship-status-dash-component-monitor
     sa.component-monitor.core-ci.token.txt:
       field: sa.component-monitor.core-ci.token.txt
       item: ship-status-dash-component-monitor
@@ -3137,6 +3162,12 @@ secret_configs:
     sa.crier.build13.token.txt:
       field: sa.crier.build13.token.txt
       item: build_farm
+    sa.crier.hvidosil.config:
+      field: sa.crier.hvidosil.config
+      item: build_farm
+    sa.crier.hvidosil.token.txt:
+      field: sa.crier.hvidosil.token.txt
+      item: build_farm
     sa.crier.core-ci.config:
       field: sa.crier.core-ci.config
       item: build_farm
@@ -3199,6 +3230,9 @@ secret_configs:
     sa.config-updater.build13.config:
       field: sa.config-updater.build13.config
       item: config-updater
+    sa.config-updater.hvidosil.config:
+      field: sa.config-updater.hvidosil.config
+      item: config-updater
     sa.config-updater.core-ci.config:
       field: sa.config-updater.core-ci.config
       item: config-updater
@@ -3309,6 +3343,12 @@ secret_configs:
     sa.deck.build13.token.txt:
       field: sa.deck.build13.token.txt
       item: build_farm
+    sa.deck.hvidosil.config:
+      field: sa.deck.hvidosil.config
+      item: build_farm
+    sa.deck.hvidosil.token.txt:
+      field: sa.deck.hvidosil.token.txt
+      item: build_farm
     sa.deck.core-ci.config:
       field: sa.deck.core-ci.config
       item: build_farm
@@ -3413,6 +3453,12 @@ secret_configs:
     sa.hook.build13.token.txt:
       field: sa.hook.build13.token.txt
       item: build_farm
+    sa.hook.hvidosil.config:
+      field: sa.hook.hvidosil.config
+      item: build_farm
+    sa.hook.hvidosil.token.txt:
+      field: sa.hook.hvidosil.token.txt
+      item: build_farm
     sa.hook.core-ci.config:
       field: sa.hook.core-ci.config
       item: build_farm
@@ -3517,6 +3563,12 @@ secret_configs:
     sa.prow-controller-manager.build13.token.txt:
       field: sa.prow-controller-manager.build13.token.txt
       item: build_farm
+    sa.prow-controller-manager.hvidosil.config:
+      field: sa.prow-controller-manager.hvidosil.config
+      item: build_farm
+    sa.prow-controller-manager.hvidosil.token.txt:
+      field: sa.prow-controller-manager.hvidosil.token.txt
+      item: build_farm
     sa.prow-controller-manager.core-ci.config:
       field: sa.prow-controller-manager.core-ci.config
       item: build_farm
@@ -3653,6 +3705,12 @@ secret_configs:
     sa.sinker.build13.token.txt:
       field: sa.sinker.build13.token.txt
       item: build_farm
+    sa.sinker.hvidosil.config:
+      field: sa.sinker.hvidosil.config
+      item: build_farm
+    sa.sinker.hvidosil.token.txt:
+      field: sa.sinker.hvidosil.token.txt
+      item: build_farm
     sa.sinker.core-ci.config:
       field: sa.sinker.core-ci.config
       item: build_farm
@@ -3751,6 +3809,12 @@ secret_configs:
     sa.dptp-controller-manager.build13.token.txt:
       field: sa.dptp-controller-manager.build13.token.txt
       item: build_farm
+    sa.dptp-controller-manager.hvidosil.config:
+      field: sa.dptp-controller-manager.hvidosil.config
+      item: build_farm
+    sa.dptp-controller-manager.hvidosil.token.txt:
+      field: sa.dptp-controller-manager.hvidosil.token.txt
+      item: build_farm
     sa.dptp-controller-manager.core-ci.config:
       field: sa.dptp-controller-manager.core-ci.config
       item: build_farm
@@ -3849,6 +3913,12 @@ secret_configs:
     sa.promoted-image-governor.build13.token.txt:
       field: sa.promoted-image-governor.build13.token.txt
       item: build_farm
+    sa.promoted-image-governor.hvidosil.config:
+      field: sa.promoted-image-governor.hvidosil.config
+      item: build_farm
+    sa.promoted-image-governor.hvidosil.token.txt:
+      field: sa.promoted-image-governor.hvidosil.token.txt
+      item: build_farm
     sa.promoted-image-governor.core-ci.config:
       field: sa.promoted-image-governor.core-ci.config
       item: build_farm
@@ -3981,6 +4051,12 @@ secret_configs:
     sa.ci-chat-bot.build13.token.txt:
       field: sa.ci-chat-bot.build13.token.txt
       item: ci-chat-bot
+    sa.ci-chat-bot.hvidosil.config:
+      field: sa.ci-chat-bot.hvidosil.config
+      item: ci-chat-bot
+    sa.ci-chat-bot.hvidosil.token.txt:
+      field: sa.ci-chat-bot.hvidosil.token.txt
+      item: ci-chat-bot
     sa.ci-chat-bot.core-ci.config:
       field: sa.ci-chat-bot.core-ci.config
       item: ci-chat-bot
@@ -4091,6 +4167,12 @@ secret_configs:
     sa.github-ldap-user-group-creator.build13.token.txt:
       field: sa.github-ldap-user-group-creator.build13.token.txt
       item: build_farm
+    sa.github-ldap-user-group-creator.hvidosil.config:
+      field: sa.github-ldap-user-group-creator.hvidosil.config
+      item: build_farm
+    sa.github-ldap-user-group-creator.hvidosil.token.txt:
+      field: sa.github-ldap-user-group-creator.hvidosil.token.txt
+      item: build_farm
     sa.github-ldap-user-group-creator.core-ci.config:
       field: sa.github-ldap-user-group-creator.core-ci.config
       item: build_farm
@@ -5081,6 +5163,12 @@ secret_configs:
     sa.cluster-display.build13.token.txt:
       field: sa.cluster-display.build13.token.txt
       item: build_farm
+    sa.cluster-display.hvidosil.config:
+      field: sa.cluster-display.hvidosil.config
+      item: build_farm
+    sa.cluster-display.hvidosil.token.txt:
+      field: sa.cluster-display.hvidosil.token.txt
+      item: build_farm
     sa.cluster-display.core-ci.config:
       field: sa.cluster-display.core-ci.config
       item: build_farm
@@ -6229,6 +6317,20 @@ secret_configs:
   - cluster: build13
     name: thanos-remote-write-tls
     namespace: openshift-monitoring
+- from:
+    ca.crt:
+      field: ca.crt
+      item: ci-monitoring-thanos-tls
+    client.crt:
+      field: client.hvidosil.crt
+      item: ci-monitoring-thanos-tls
+    client.key:
+      field: client.hvidosil.key
+      item: ci-monitoring-thanos-tls
+  to:
+  - cluster: hvidosil
+    name: thanos-remote-write-tls
+    namespace: openshift-monitoring
 - from:
     ca.crt:
       field: ca.crt
@@ -6315,6 +6417,34 @@ secret_configs:
   - cluster: build13
     name: dex-rh-sso
     namespace: openshift-config
+- from:
+    hvidosil-id:
+      field: hvidosil-id
+      item: dex
+    hvidosil-secret:
+      field: hvidosil-secret
+      item: dex
+  to:
+  - cluster: app.ci
+    name: hvidosil-secret
+    namespace: dex
+  - cluster: core-ci
+    name: hvidosil-secret
+    namespace: dex
+  - cluster: app.ci
+    name: hvidosil-dex-oidc
+    namespace: ci
+  - cluster: core-ci
+    name: hvidosil-dex-oidc
+    namespace: ci
+- from:
+    clientSecret:
+      field: hvidosil-secret
+      item: dex
+  to:
+  - cluster: hvidosil
+    name: dex-rh-sso
+    namespace: openshift-config
 - from:
     clientSecret:
       field: token
@@ -6410,6 +6540,14 @@ secret_configs:
   - cluster: build12
     name: aws-sts-cluster-config
     namespace: ci
+- from:
+    home_role_arn:
+      field: hvidosil
+      item: aws-sts-cluster-config
+  to:
+  - cluster: hvidosil
+    name: aws-sts-cluster-config
+    namespace: ci
 user_secrets_target_clusters:
 - app.ci
 - build01
@@ -6425,6 +6563,7 @@ user_secrets_target_clusters:
 - build11
 - build12
 - build13
+- hvidosil
 - core-ci
 - hosted-mgmt
 - hosted-mgmt2