Merge pull request #164 from smarunich/cr-pull-secret

adding support for cr-pull-secret for wasm

Author: smarunich

infra/aws/outputs.tf

@@ -2,6 +2,15 @@ output "registry" {
   value = module.aws_base[0].registry
 }
 
+output "registry_username" {
+  value = module.aws_base[0].registry_username
+}
+
+output "registry_password" {
+  value = module.aws_base[0].registry_password
+  sensitive = true
+}
+
 output "public_ip" {
   value = module.aws_jumpbox[0].public_ip
 }

infra/azure/outputs.tf

@@ -2,6 +2,15 @@ output "registry" {
   value = module.azure_base[0].registry
 }
 
+output "registry_username" {
+  value = module.azure_base[0].registry_username
+}
+
+output "registry_password" {
+  value = module.azure_base[0].registry_password
+  sensitive = true
+}
+
 output "public_ip" {
   value = module.azure_jumpbox[0].public_ip
 }

infra/gcp/outputs.tf

@@ -2,6 +2,15 @@ output "registry" {
   value = module.gcp_base[0].registry
 }
 
+output "registry_username" {
+  value = module.gcp_base[0].registry_username
+}
+
+output "registry_password" {
+  value = module.gcp_base[0].registry_password
+  sensitive = true
+}
+
 output "public_ip" {
   value = module.gcp_jumpbox[0].public_ip
 }

modules/aws/base/main.tf

@@ -85,3 +85,5 @@ resource "aws_ecr_repository" "tsb" {
   }
 }
 
+data "aws_ecr_authorization_token" "token" {
+}

modules/aws/base/outputs.tf

@@ -14,6 +14,14 @@ output "registry_id" {
   value = aws_ecr_repository.tsb.registry_id
 }
 
+output "registry_username" {
+  value = data.aws_ecr_authorization_token.token.user_name
+}
+
+output "registry_password" {
+  value = data.aws_ecr_authorization_token.token.password
+}
+
 output "cidr" {
   value = var.cidr
 }

modules/azure/base/outputs.tf

@@ -18,6 +18,9 @@ output "registry" {
   value = azurerm_container_registry.acr.login_server
 }
 
+output "registry_id" {
+  value = azurerm_container_registry.acr.id
+}
 output "registry_username" {
   value = azurerm_container_registry.acr.admin_username
 }
@@ -26,10 +29,6 @@ output "registry_password" {
   value = azurerm_container_registry.acr.admin_password
 }
 
-output "registry_id" {
-  value = azurerm_container_registry.acr.id
-}
-
 output "cidr" {
   value = var.cidr
 }

modules/gcp/base/main.tf

@@ -91,3 +91,22 @@ resource "google_compute_firewall" "tsb" {
   }
 
 }
+
+resource "google_service_account" "gcr_pull" {
+  project = var.project_id
+  account_id = "${var.name_prefix}-gcr-pull"
+}
+resource "google_project_iam_member" "storage_viewer" {
+  project = var.project_id
+  role = "roles/storage.objectViewer"
+  member = "serviceAccount:${google_service_account.gcr_pull.email}"
+}
+resource "google_project_iam_member" "artifact_reader" {
+  project = var.project_id
+  role = "roles/artifactregistry.reader"
+  member = "serviceAccount:${google_service_account.gcr_pull.email}"
+}
+
+resource "google_service_account_key" "gcr_pull_key" {
+  service_account_id = google_service_account.gcr_pull.name
+}

modules/gcp/base/outputs.tf

@@ -13,6 +13,13 @@ output "registry" {
   value = "gcr.io/${var.project_id}"
 }
 
+output "registry_username" {
+  value = "_json_key"
+}
+output "registry_password" {
+  value = base64decode(google_service_account_key.gcr_pull_key.private_key)
+}
+
 output "cidr" {
   value = var.cidr
 }

modules/tsb/cp/main.tf

@@ -121,6 +121,31 @@ resource "kubernetes_secret_v1" "cacerts" {
   type       = "kubernetes.io/generic"
   depends_on = [helm_release.controlplane]
 }
+
+resource "kubernetes_secret_v1" "cr_pull_secret" {
+  metadata {
+    name      = "cr-pull-secret"
+    namespace = "istio-system"
+    annotations = {
+      clustername = var.cluster_name
+    }
+  }
+
+  data = {
+    ".dockerconfigjson" = jsonencode({
+      auths = {
+        "${var.registry}" = {
+          "username" = var.registry_username
+          "password" = var.registry_password
+        }
+      }
+    })
+  }
+
+  type       = "kubernetes.io/dockerconfigjson"
+  depends_on = [helm_release.controlplane]
+}
+
 resource "helm_release" "dataplane" {
   name                = "dataplane"
   repository          = var.tsb_helm_repository

modules/tsb/cp/variables.tf

@@ -72,7 +72,10 @@ variable "tsb_image_sync_apikey" {
 
 variable "registry" {
 }
-
+variable "registry_username" {
+}
+variable "registry_password" {
+}
 variable "es_host" {
 }