# Example only — DO NOT commit real credentials.
# The real secret is managed as a SealedSecret in the cloud-host-gitops repo
# (sealed-secrets/kaniko-harbor-auth.yaml).
#
# Kaniko pushes via harbor-core (Harbor UI metadata). Pull base images may still
# use harbor-registry:5000 — include auth for both hosts in one dockerconfigjson.
#
#   ADMIN="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.HARBOR_ADMIN_PASSWORD}' | base64 -d)"
#   REG_PASS="$(kubectl -n cloudhost get secret harbor-core -o jsonpath='{.data.REGISTRY_CREDENTIAL_PASSWORD}' | base64 -d)"
#   kubectl -n cloudhost-builds create secret generic kaniko-harbor-auth \
#     --from-literal=admin="${ADMIN}" --from-literal=reg_pass="${REG_PASS}" --dry-run=client -o yaml | ...
#
# See RUNBOOK-CICD.fa.md for the full procedure.
apiVersion: v1
kind: Secret
metadata:
  name: kaniko-harbor-auth
  namespace: cloudhost-builds
type: kubernetes.io/dockerconfigjson
stringData:
  .dockerconfigjson: |
    {
      "auths": {
        "harbor-core.cloudhost.svc.cluster.local": {
          "username": "admin",
          "password": "<HARBOR_ADMIN_PASSWORD>",
          "auth": "<base64 of admin:password>"
        },
        "harbor-registry.cloudhost.svc.cluster.local:5000": {
          "username": "harbor_registry_user",
          "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
          "auth": "<base64 of harbor_registry_user:password>"
        },
        "registry.abrban.com": {
          "username": "harbor_registry_user",
          "password": "<REGISTRY_CREDENTIAL_PASSWORD>",
          "auth": "<base64>"
        }
      }
    }