Phase 3 — Registry Auth & imagePullSecret¶

Work in Progress

This page will cover: creating imagePullSecret per namespace pointing at Harbor, and wiring it into Helm chart values.

Steps to document¶

[ ] Create Harbor imagePullSecret in each namespace
[ ] Store Harbor robot credentials in Vault
[ ] VSO renders imagePullSecret from Vault (production pattern)
[ ] Verify: kubectl describe pod shows no ImagePullBackOff

imagePullSecret — how it works¶

Helm values
  imagePullSecrets:
    - name: harbor-pull-secret   ← name of the K8s Secret
          │
          ▼
kubectl create secret docker-registry harbor-pull-secret
  --docker-server=harbor.cl1.sq4.aegis.internal
  --docker-username='robot$ask'
  --docker-password='<token>'
          │
          ▼
containerd authenticates to Harbor before pulling each image

docker-registry is the secret TYPE, not the name

kubectl create secret docker-registry <NAME> — docker-registry tells kubectl to create a kubernetes.io/dockerconfigjson typed secret. The name (harbor-pull-secret) is what goes in imagePullSecrets:.