mward4
9dbe3749ba
- build chain: project, Gitea basic-auth source secret, output ImageStream, BuildConfig (Docker strategy, ubuntu:24.04 base), optional base-image ImageStream and Docker Hub pull secret - runtime: ServiceAccount + least-privilege SCC and its RoleBinding (VShell needs UID 0), PVC for config/certificate, Deployment with ImageStream trigger, ClusterIP Service, passthrough HTTPS Route - all manifests verified with 'oc create --dry-run=client' against the OpenShift 4.22 client scheme (12/12 decode cleanly)
29 lines
1.0 KiB
YAML
29 lines
1.0 KiB
YAML
# Optional: Docker Hub credentials for the build's base-image pull.
|
|
# Anonymous pulls of docker.io/library/ubuntu are rate limited and builds fail
|
|
# with "toomanyrequests" on a busy cluster.
|
|
#
|
|
# Create it with your own credentials (do not commit them):
|
|
#
|
|
# oc create secret docker-registry dockerhub-pull -n vshell \
|
|
# --docker-server=docker.io \
|
|
# --docker-username=<dockerhub-user> \
|
|
# --docker-password=<dockerhub-token-or-password>
|
|
#
|
|
# # let build pods use it for pulls
|
|
# oc secrets link builder dockerhub-pull -n vshell --for=pull
|
|
#
|
|
# If the cluster already has a global pull secret, linking it is enough:
|
|
# oc secrets link builder <global-pull-secret> -n vshell --for=pull
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: dockerhub-pull
|
|
namespace: vshell
|
|
labels:
|
|
app.kubernetes.io/name: vshell
|
|
app.kubernetes.io/component: base-image
|
|
type: kubernetes.io/dockerconfigjson
|
|
stringData:
|
|
.dockerconfigjson: |
|
|
{"auths":{"https://index.docker.io/v1/":{"username":"REPLACE","password":"REPLACE","auth":"REPLACE_BASE64_USER_COLON_PASSWORD"}}}
|