Use Secrets to merge cluster pull secret entries
This component manages the cluster’s global pull secret (pull-secret in namespace openshift-config).
Other components can create Secrets with their own registry credentials.
The ManagedResource merges the auths entries of these Secrets into the cluster pull secret.
Entries which are present on the cluster but aren’t contributed by any of the merged secrets are left untouched. This means the component coexists with the OpenShift installer and with other controllers which maintain their own entries.
If multiple secrets set the same registry host, secret precedence is determined by ascibetically sorting the secrets by their metadata.name.
Secrets which sort later have higher precedence.
Values set through the component parameters have higher precedence than any values set through labelled secrets.
Example
Create a Secret in your component:
apiVersion: v1
kind: Secret
type: kubernetes.io/dockerconfigjson (1)
metadata:
labels:
pull-secret.openshift-config.syn.tools/include: "" (2)
name: ecr-dockerconfig (3)
namespace: openshift-config (4)
stringData:
.dockerconfigjson: |- (5)
{
"auths": {
"123456.dkr.ecr.eu-west-1.amazonaws.com": {
"auth": "..."
}
}
}| 1 | Any secret type works, the component only reads the .dockerconfigjson field. |
| 2 | Label the Secret so it’s picked up by the ManagedResource, see Parameters for the value. |
| 3 | The Secrets will get sorted by their name before merging. |
| 4 | Apply the Secret to the openshift-config namespace. |
| 5 | Use the key .dockerconfigjson for your configuration. Only the auths field is read. |
The ManagedResource records the secrets it merged in annotation pull-secret.openshift-config.syn.tools/active-secrets on the cluster pull secret:
kubectl -n openshift-config get secret pull-secret \
-o jsonpath='{.metadata.annotations.pull-secret\.openshift-config\.syn\.tools/active-secrets}'|
The |