# Example only — DO NOT commit real credentials.
# The real secret is managed as a SealedSecret in the cloud-host-gitops repo
# (sealed-secrets/kaniko-harbor-auth.yaml).
#
# Kaniko pushes directly to the internal registry endpoint
# (harbor-registry.cloudhost.svc.cluster.local:5000), which bypasses harbor-core.
# That endpoint only accepts the internal registry credential — Harbor robot
# accounts do NOT work there (their tokens are issued by harbor-core's token
# service). Use the harbor_registry_user credential from the harbor-core secret:
#
#   REG_PASS="$(kubectl -n cloudhost get secret harbor-core \
#     -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
#   kubectl -n cloudhost-builds create secret docker-registry kaniko-harbor-auth \
#     --docker-server=harbor-registry.cloudhost.svc.cluster.local:5000 \
#     --docker-username=harbor_registry_user \
#     --docker-password="${REG_PASS}"
#
# The build-deploy workflow mounts this secret at /kaniko/.docker/config.json
# inside every Kaniko Job. See RUNBOOK-CICD.fa.md for the full procedure.
apiVersion: v1
kind: Secret
metadata:
  name: kaniko-harbor-auth
  namespace: cloudhost-builds
type: kubernetes.io/dockerconfigjson
stringData:
  .dockerconfigjson: |
    {
      "auths": {
        "harbor-registry.cloudhost.svc.cluster.local:5000": {
          "username": "harbor_registry_user",
          "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
          "auth": "<base64 of username:password>"
        }
      }
    }