commit 24f5d3748ff729ef4047217834fbe64035d4b82c
parent f918b48ba4bcb87e2300d09e4e1e47046d399aa4
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 25 Mar 2026 21:20:52 +0100
ensure we load the pubkey properly
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
4 files changed, 32 insertions(+), 9 deletions(-)
diff --git a/infrastructure_talos/controllers/zot/configmap.yaml b/infrastructure_talos/controllers/zot/configmap.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: zot-cosign-pubkey
+ namespace: zot
+data:
+ cosign.pub: |
+ -----BEGIN PUBLIC KEY-----
+ MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOpUp7l1T+CPFS3BhcBv9DQXNXJtK
+ p87SB7ZXZL5FactrIJ9Ezx1dhIWEB5YJmrXHowKksl1I7iwGpb13rFnGNQ==
+ -----END PUBLIC KEY-----
diff --git a/infrastructure_talos/controllers/zot/kustomization.yaml b/infrastructure_talos/controllers/zot/kustomization.yaml
@@ -3,5 +3,6 @@ kind: Kustomization
resources:
- namespace.yaml
- repository.yaml
+ - configmap.yaml
- secret.yaml
- release.yaml
diff --git a/infrastructure_talos/controllers/zot/release.yaml b/infrastructure_talos/controllers/zot/release.yaml
@@ -44,3 +44,14 @@ spec:
externalSecrets:
- secretName: zot-secret
mountPath: /etc/zot
+
+ # Mount cosign public key into _cosign directory so it persists across pod restarts
+ extraVolumes:
+ - name: cosign-pubkey
+ configMap:
+ name: zot-cosign-pubkey
+
+ extraVolumeMounts:
+ - name: cosign-pubkey
+ mountPath: /var/lib/registry/_cosign/cosign.pub
+ subPath: cosign.pub
diff --git a/infrastructure_talos/controllers/zot/secret.yaml b/infrastructure_talos/controllers/zot/secret.yaml
@@ -4,8 +4,8 @@ metadata:
name: zot-secret
namespace: zot
stringData:
- htpasswd: ENC[AES256_GCM,data:mGjf4jSUSRW1gfOojdBUaquvzXsD/ZDu7OKu/fwoekfQFdBpapqQpN7axTOM0AugpVuEIXvOxej0CJ971ysHygPeSw==,iv:nVJ5G75XXHKzpuVumk0C168MHX3SvlZZIhOdVZLIFtA=,tag:bcNFf1lDnm8HlQ7Cyr/i/Q==,type:str]
- config.json: ENC[AES256_GCM,data:MJN3hsthqQJm9fmgqvjcle4QgOd2uOGXdhX9AA2YS9gJh4IbN6V9LibIKPrNWZ57vgWJnAv0B2x7zjOqbC/Tzwkorj3WVbUsHxyX1CDfu1jGj5ToyPvWND6j4eDATlg3cyAOngkE/zDBKOfZXxuALC1+OFBY2ftybBOtmqA8WQ22eIpHD6HhsSi57lJKno/DQNJ66odNxHyPdcJfukdkuIXsyBWyFct4yv+DLL+Y/q3gnPkKYjsd9ys6x5EBmJgsnhTaJ7NXN0z5UEjtVcrhBUHlmAEvmFCwiMreiDTp6xauT/nACo8k4TGzi3U0cvxZewdQCngClDYxREKXOwJm1yBsBunww3Quw6x0F7MyH9L01Brjr00AC0xW345/BUzlr3ISO7L2WXOtqzAE9aBkG7We2McT63Hvg/ASw1p8ufT70uCpd66otoX8xueFFM+fqOmKmMC991ncokRW/8CBFp82n8tX/fWA4qsZBseYza4v8sw/fXnBJgtDCToWlFZXyL5IBspNaXmr9V3dmbpKbo4D+TLFbp8iK1tUGWlZYgYyceYuOU7casF/TBJvrag3zUJ/btretOlk9F0gvJNQw520z5ePNyzG/zqjqQm/GbFGRbhWLlHQ+dHn8rNbgbdUjvmykgwVwd8JfeMoxhRTrfRQMqZIyYrAMV7y3QT7mmon1tR4Y7hocLFl83EUgIsRPGTC4tyoY3L/PAE5s3yXTTFYMj4TgwE0lnAZNIHwixPnnG52Z7s1U+3NE4e10VZTDDptQddxH9ZAWBaYKsKD1KXOChGvnowRJft+JYYOm3rOCPXirGxOtDICb9y/323VsSwgylu+11jB8kS3D+PtXMv7zmy6r+/aoi+rx2aV/JbPn7Oxx/ccMoty/3YbStlxZzPBOgu1fA+RrHk78MByHkkxTlvvM+Gk3PN3HsEVqGJPGLk6aFfHfmfP6MN6qLgA6yHu3FmRrfEutX4oHx8tCDBXh2HvDGV9OUICKx+Q2FC5eskWLK6MqOapLQQrcTM4T8TWvlpAYWJR/Kn7Bd+kB3zrlycVeVQTVw03oQlcQh9112PfdUYD54TlUEtieN1IRW6ZqvaDVoNLo+RSbWqGNqCMdehsnIRbtv75mhNYncGL7uJ2gAl4Tj/znhzXkWkLZTq0sX3guw6YupbjtkTzEl282EyxdT858V9M/dLqP2MNLmpeupeiH+cOC/9d/IAUkrtpHxBUFHlYH8MxZjhOfaUFlcvKpLGDRVwDM5vfxmCdTETR5HosJQ+E5CUXD278dMH9ZpM84J9kkK7iUEzJMBzXdzya+g/l2e4Y6NwC4OE/O2xtcBZRA8yYFtQkHnGFmKn2VyIAM5hx1eVsBNb9GhjDjSt1FAhlnD+ds5p9V05RyBWVe7ATF+RPV9wkLIqg6hqsZPg+xiZkym6j1uSMBKRcl8PZT21UmRBa/mYk40wBtbJB3H7kaK50wfO7QH+yI94JgsseaVKfgQISQSnYbmmAnCYEwpBKgV9Y0MK1iri6wcLErDgN0kkLRFZT+f55XeFX,iv:ntKUHUO+mdy3fKLffjholdHjWZL9NwtgRnK6Jfhh0ug=,tag:IoDco82vTVhJrVCP1R5Lbg==,type:str]
+ htpasswd: ENC[AES256_GCM,data:JZizdfWMjp5b/qx/05mJbWfAFpIj7vSc+fAbHzuK5JA9hB7rqDHDTovJgNpZdtxZ/IsHzuOOMcV9XcVhkbvXusZeaw==,iv:wpstOUkrYnRhGVOMRK0tzjiwuQhCghooZvjtXK59b4s=,tag:ySgdZUdMNy3Uxjjp1+RwKA==,type:str]
+ config.json: ENC[AES256_GCM,data:bKvi3dimMJXGjxtzwtpKDecnWRHWiqjonFFFnbsfZIAafp0TnyPfI/CeUzsI2B2Q2eSs7ya/TThgCehiRoPJdxPFRB5IVE7B4iijwlq1gWB9/Vgm6eCLvLXAgd3jjUj6SpR688trblDJFCgTXF/50QsykdaFJf1cOvk8FYceMHYYPkvOAUe3ryszIQP+3gebFUneeZXAv3ExujrxGWFmEjxVntYN0XoJaXp6w/IlByD060/1N16AknramhYVQxRxwpgc+lZA5YBszR38KvGWt8Ry9PK9MdatitjmQy3TntIqyYPgi1w6W+iwSonbpvu+4JssU9X7sHRa10bW0EiIL8Qi9h5ST2lmgdvNVjfHsinpA7Lb9OfRLLzUClLrmijMZhvMCrWMcqNZOGALo1FGxaOZVcVJg2+ukfp/TAgBZGAsOuABpCQtw9JE+SvSe92JZ7G9YktdjnK+GZhYvuINnjOM68XMV3AkI2+bH7V9A4ZTf0b4PATLvH5tJMteJH5SYSUaNTesIlo8pukPTvoaS9b9/V5Lw50kjgKMQZEtcZf8gyVMgTBSPfhVJHmf+2S3yvYpaNp8nyyRyAjTBK6WOUhd20QDOyNOZHFTNypbhA2Lnc3J/Pyl6KRZlyRXdBxlvtJvF2fUrRbQv6DB0E8VEblpUDL3VNOF5MReLbcdNejxa5eSvLosHIYjzdCUcN3jLBbAlKGbCW/myarTXXkW6BiB64Tngg4LBPXZpcEdRtqeV2uD5Gi1PbAe8LJInPUy3BkIXGE20k/TVMS8xb2gutYjRByCgzyUsNc9QPwHjWEN8zbwIXND/MvBjLeMu9vvCuIPtEM0daunXfex49ls/gQ7RW4c9kvd2qq//xm3/EU1/zM5IHS3m5B5uhnmddu15MsBWsTgriXZva6gL0l6F2Bn+Pr6JEuEjisjZnXWDPTYdJGzeuYjTgFTNskPjjn16Mv5wRfDznmATaWiATpfcHQ8poiIEqxHyc4P4/DRI3dhjRcdXX/FaVyhJyVmpgkAw6goJu6WBhdsGlj3W651E85MxzLZ6KdEKT2ItNMbY3itwFy4HSVm3V5YrfPuU24ba7IICVdAAJfgfYfvNl66xvJCIZscbEOjRgK1lJX6thV+CKJqgq/K4U08uuBNHvNtGMz7NXcSHATjMdXCDp/lgmKCQ7ztJne+cUipB44G0BCKGHrA455H87w/FaySLrUYE3kCCcKN2HR+41Q4xDzFRj4+l2HkgI61ULGoQGIYj6N2A2AwF7A8GcKMZpdLxfmFVQHP/3pJF9W1uFd3XX1hUe7hEhyqx5QU8ftEmj/lrnKlfrq0Jq6UDKPgEMFuribe3NXDsnij+PuhsYuPHEY77SORk3ERq1QfqcrFvlSpSSOsovojyqvmsPmTKzN7K3KYiS0H5rkZkbXMX7jeDmxTAV7STnYYi0lhaWlQRIB0cEb/5xASWg4mt/X4M923qRHbySz+tJVf5BKT4lwIxiOuL1Dz5dI8wxks6tb4zVNRWe7TASlGBVySF99IM9mbfdkmmsqk,iv:2w5QEDnQXc6QPUvRLjMoI1fSaeY6Y4X7eAOgEs3QRWc=,tag:NhZz2NMgrSzLotKhBtUqxA==,type:str]
sops:
kms: []
gcp_kms: []
@@ -15,14 +15,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwU2twbDJGMmVaVWE3Q1pj
- bzBGVEpQZjI1L2lVbmcrbHI2b0pQM1pIYlNRCnlJTTRkb2hHNm5jZHhidUpacTgr
- RFJuME4rZzZ3SUt5YWs2bFJVc0lVUm8KLS0tIGFkSHNudFVzNzgxR3lMZml0SHdV
- OG1iS1laTHlzdWdLNlMyelQxZ2M4ZkUKwhjYwBNBjxOUL8FCEfq7W9ledsDAF4mx
- bb4WToe/NS00M5ngCx/q2hBqs07A1IU5wEfrYhF/SYLE23Gc7oaj/w==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzcnNrQmxSQzlUelEwaUQx
+ MzJRS29COVR2SVFIaFlwZ0ZSbkRrRDhmV1NFCng3YWxCWlgvVVFZR0NadzRDZWhy
+ OGlFU0YyV3A0VHZwQU9EOVpZUXRKUUkKLS0tIDRzRlV2TWRLU0NuZ01kWUxjNG1q
+ RFpkNWhwYm9Cb1hLMVVaQU1XcXp2UXcKcsPaSEQ4PAKcpAkh8bQfokszkm2SciQB
+ k0ptynAkSQsg0P+XecfekRu3hTkXsaxc6aRr0c6U7xjN8Oa2UZNPig==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-03-25T19:49:46Z"
- mac: ENC[AES256_GCM,data:udWKtZmBksr5gFSih9Pj7ghjxXUTQoWnsms8+smDOW+nTZbqhWelhPo4/a+Awiv1eulf/FsKDHAugKzO1Zuj9195FXUahfVdlFmpliXgF6BR/tmDmF3VhUG8h7cuZ6hVH7+b/ZC3yrcmsjp+jXbLMTs0qkREg4fEqM6BnkY12tU=,iv:fSPK3BzCtd+wMRHP3wnFFdn5dzhRbrQIGLODMzYEawI=,tag:xxHLYD0+B933nXc2CtF/MA==,type:str]
+ lastmodified: "2026-03-25T20:20:40Z"
+ mac: ENC[AES256_GCM,data:i2adkqWsG3xUvdQ7b3djskXSkPgwAsUm+RxgTwZJFDyCmmgeTac3D3+L7BedCXr7xUVXd1fRrkS1hLhxFxrBXCPXyTUBH/obmcNJBdr0ehsMIiUNlVEkxyFLtyenr8DVgKLPID4do1tk8cdXjgPYbvA5QD4oYgU4V2M/qlRA3ZQ=,iv:2Ui21owXoi6lKA8rgreig+ODzkfTPiMm5tfqT8V03/s=,tag:Fn6JLhUCtBdYzDAT0DCowg==,type:str]
pgp: []
encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
version: 3.9.1
