commit 6cde6325d5c20cd17ae3de796dee30428864d576
parent 00f8687ff8ca465402516a9f0d677ed11459ad58
Author: MTRNord <MTRNord@users.noreply.github.com>
Date: Wed, 25 Mar 2026 20:38:33 +0100
fix env substitution issues
Signed-off-by: MTRNord <MTRNord@users.noreply.github.com>
Diffstat:
2 files changed, 11 insertions(+), 90 deletions(-)
diff --git a/infrastructure_talos/controllers/zot/release.yaml b/infrastructure_talos/controllers/zot/release.yaml
@@ -40,85 +40,7 @@ spec:
cpu: "1"
memory: 512Mi
- # Required: mount the configFiles ConfigMap into /etc/zot
- mountConfig: true
-
- # Zot config — S3_ACCESS_KEY and S3_SECRET_KEY are substituted from env vars at startup
- configFiles:
- config.json: |
- {
- "distSpecVersion": "1.1.0",
- "storage": {
- "rootDirectory": "/var/lib/registry",
- "dedupe": false,
- "storageDriver": {
- "name": "s3",
- "region": "hel1",
- "regionendpoint": "https://hel1.your-objectstorage.com",
- "bucket": "midnightthoughts-registry",
- "forcepathstyle": true,
- "secure": true,
- "accesskey": "$S3_ACCESS_KEY",
- "secretkey": "$S3_SECRET_KEY"
- }
- },
- "http": {
- "address": "0.0.0.0",
- "port": "5000",
- "auth": {
- "htpasswd": {
- "path": "/htpasswd/htpasswd"
- }
- },
- "accessControl": {
- "repositories": {
- "**": {
- "anonymousPolicy": ["read"]
- }
- },
- "adminPolicy": {
- "users": ["admin"],
- "actions": ["read", "create", "update", "delete"]
- }
- }
- },
- "log": {
- "level": "info"
- },
- "extensions": {
- "search": {
- "enable": true
- },
- "trust": {
- "enable": true,
- "cosign": true
- },
- "ui": {
- "enable": true
- },
- "metrics": {
- "enable": true,
- "prometheus": {
- "path": "/metrics"
- }
- }
- }
- }
-
- # Inject S3 credentials as env vars for config substitution
- env:
- - name: S3_ACCESS_KEY
- valueFrom:
- secretKeyRef:
- name: zot-secret
- key: S3_ACCESS_KEY
- - name: S3_SECRET_KEY
- valueFrom:
- secretKeyRef:
- name: zot-secret
- key: S3_SECRET_KEY
-
- # Mount zot-secret (contains htpasswd) at /htpasswd
+ # Mount zot-secret at /etc/zot — provides config.json (with real S3 creds) and htpasswd
externalSecrets:
- secretName: zot-secret
- mountPath: /htpasswd
+ mountPath: /etc/zot
diff --git a/infrastructure_talos/controllers/zot/secret.yaml b/infrastructure_talos/controllers/zot/secret.yaml
@@ -4,9 +4,8 @@ metadata:
name: zot-secret
namespace: zot
stringData:
- S3_ACCESS_KEY: ENC[AES256_GCM,data:ayFtIkZV23p3dZ+VcddNQMV131I=,iv:YzYKjwNMjLV5APThdt2idXJlvfZ0+HdoK5gEGY0M858=,tag:qOlFOEk2pTnRu0aZzKsVng==,type:str]
- S3_SECRET_KEY: ENC[AES256_GCM,data:IFshZzzZZFW17GdCOPsVTvD3T+rwjTdIxtKigGC0akQzEHdZtss6Ug==,iv:9DADsIj8Z7DbKuUnej3Wp9xRtNEFqfVWNGrZBXTpLeI=,tag:cushbfNW+z6dEPFiUnGcgg==,type:str]
- htpasswd: ENC[AES256_GCM,data:cQFylOYHl3SUMFqze2vsii+hTx67i4aKQWdiDbweNgH3A6wIHk5M8/VNethg5MVS8gffDHDoBBQTm7RxkiJGGQmV/Q==,iv:anJh0qpyv/TnjqKl/guo156+g8g55AYChPnuw96kQtg=,tag:Bd/BLua4F8qqTRkOh+J3aA==,type:str]
+ htpasswd: ENC[AES256_GCM,data:LIFk5aE4WxSWVgp+IVo15/2qe8TyIykBKwhkt2BeoY6I5W/xZ5aJd205zicwuKkhAokCK5E+Ian2wSFBhtBwLKYiAw==,iv:U6dFSOwZcCCoWP7LSXI9oMnADt0O+8sLEmQOGCd4Mkc=,tag:e3Er3Us/42B63VwIS4WMsQ==,type:str]
+ config.json: ENC[AES256_GCM,data:3v0OcHlpJnvutn50Gkrmw3YwWnuFUNTdkHaXKugdKYPh48Yda2Ku3EYCw2wGKkmoVbfFbYMTXo2tXqUXlSZNwUWqkQch93PWt1mXO8AIGs1qMJA9clkjcOIcwvzxckXh3iuiDb97w8Xdq1xkmdyti9oicDdSXDjybfMi7G5Q+TMZcpeOX7Afp7UXtbDmmkRwYnA0FcieAPDw9fvtCBn2miuuefkia1Jx2jzw0BPYG8EZOHuzdJ46BHmkTt62ys9ZSL+g3YzHpSmR9+gfEXC1bJAYDlyduXZPkJNQr09Z0BQZGuZ2TYTnGkD2reissso4387kxk2SIN7ZRb7HbJV59y9Nkal0CcjjYtsrz31SJw0K9kSNxNCzGZxjSh2dmML6EhMl4sCFPFWXIY0x9dXMUYLa6hai7B2MRfYtGRym+VGnsYeoa2ymWnTlcRWBVaZlvOv19tvR8AxhQxFIC2LuNn4v9zTlMgFZLie1oE036/ub6xVme+lGthA0+V10i8Me2Ee9g/P6cCkq3PRkOcMjICk0GGK9rMdM0ZnNLRNE3Bl+e1Qa/WnKbWQcVQkAvUACn2IiAd2N0eXG2YBZsvx1lllbRk0vt1HH0ryNhcfiex0vea5jNnZuGR9xIfMBJk2X43FlAhfrBGWeSdSJEykreq+kjRK80sb15ghYM7Qi43LAhQjKt59XK+ZfHGOLFAC8TkWB4JI07+BQOgywvGZNRjOYAVVX7Bh82GOQaREftAUHJHeTpGm6VIMEp+tzUFyY+JhjYZdtxlzvqblS8VbtsDbExi2EZbE/n3BJBE91I8lhJs/CCgDVOQusdWGcnDpHUd8wwkYaJOqMGAdy0Zx5yRlsn9pnwN85sOobBfR13VFFfanj7AlZaHk5ajx65uUpxX0iIJlwG6wy72GtBaYJEJ8th01VrrThxEFODkkk51MnKZgSyKFegfpKCTNTydSwieiIuiFxYCrsYTSzVUVfye5cluqXCFuqgmbCgduIFbwt3r+c2gxIgDYERfrQdlBvKoTjLczzNb8aNHdwE8eqxTwS4OI6uUGlOD5uXE0tgMjMTi1jeF0pfW53bpVx6h8U+K1Q4K2S1+CrH+4ABslmO6jVd5REG3kqjgIpoIKvAoGDe8vzxyeaQTWccE1JSfAGbD3J8taHxP2y31a1CSo6sLb1JghFYUZa6BHhfHkmuIrxiC1+TiR5TdrtCnh1rF6pmjrB0B2q4XTS5/ykvYK+sFw/MqAM/mXwRABI7WqOVDiKgTuhIJoDZBJlRjD4FNM6S1RXXejpCY/gyDneIdQoqCr0QrzMfP0q0p/t4aH0TdJ+7dK/0Yt7JgQla14dtXWcL5LWf+zq5hp1/ADPy92ICYTax3jb32jR9BO7UTwPtphysqdWUXVYSlHEFJdoxTxdF40FYdLYHRXh5SFAitKpamZjuOOuIXT+vZtcsMJ+rAbrIaFtjXUrYT4DumBzgQCs/2ABmNhamNZ2sdovAhQK/fnRT3fjfEkFhcRYaTBQiGCUQiz/i5AnI3hfiMIOCIjVG3Bg,iv:vxBzhqLcRQWoMWCvVfR/jhW+nnw9xOfN7QsXH1TTATg=,tag:fogxf4B1dwYaidRcMpKpCg==,type:str]
sops:
kms: []
gcp_kms: []
@@ -16,14 +15,14 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSFVYY3pKajR3NGs1TXE0
- Z0N4K2Y5NVNCWG9Ya0Z6SHJRQnhEcFV0WDN3CnZ2R05xY2xKalhrbExjdGlFVzJj
- bEE3U2MxaHFzUGxtVy9KYVRIK01ZRkEKLS0tIFQvOW5jV1hhMzAxb2pTVVV1S3Bo
- a1pmM3JrQnlKdnZReUE2MkxKREx1ekUK8O48IXf57lslwHG+sCDQXRenJ9bZw6DR
- RDNwVoortk0cBV5EFj74a//L9j9zLldm3SsJooJ/AKLc7mW1GQZJ5w==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxUkR1MmtFVVh1d3ZCbUhB
+ UW9TUWI5S3dwUVNudkhHUEltMUw4eUVxWjJNClhiNEttWnNDcmF4U2tlWHdESVNr
+ b25lNVZBWlNvVFdHQUhwZ1JWWVFHTkkKLS0tIDYzVnFUK3lSdXVFcWQxa0RDZGlv
+ dkx6QXZMTzJzRXNWckhuSW5qenpVTXcKbTRdpZYu/P38ABuzWGEEvd1+HDsnAuTg
+ CU/o1mKWNLBUbsJuPzc1PDu5i2Qnpe8hO/A+6aceKGfeKChp/KHAgg==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2026-03-25T18:31:29Z"
- mac: ENC[AES256_GCM,data:6SvE/Q59oArOLtkO2O9x2OzGv6UZvTjigtB2v3+42wQfoj7Ul5RNaLEYsufRY2nmKLwFxqSRvBxBkY4PTf7sVJRrLK71SOJJTxoeSHyjhulbnjYqvf0V5tketnebSg53xAyujX2gtaALZy+3RqcbP5Hj/Lw9f1qC7HhKEWsO6DQ=,iv:bbfodl/8cYFTq4vIVlcXf4wA7GUkm662zSyMuP8LrFg=,tag:Qo1P1ETqRf+jGGEXdntiFQ==,type:str]
+ lastmodified: "2026-03-25T19:38:19Z"
+ mac: ENC[AES256_GCM,data:OY5ZfdpNA3p1PwcXxxTiqdu5aI4YlJ+jKXEIZbK8U+9NVBC8YIYDhnvZOvm0UrBZ3mgTb2i/sbMg8VMRa5BACHkgHL+e9QwAr3O7RtLqSSEInmOFNaLDNlDUoTRrowLco9pbiW7/xRiptgGvvCwEnDW1ipmsSCLfXJbW9ik7o7Q=,iv:aHfVijuojEcJnYCXvgm+b2yMf6Uabz0AwN2b4oFzXXU=,tag:JLOtNRapACaTAdkBD1YVYQ==,type:str]
pgp: []
encrypted_regex: ^(apiKey|appUserPassword|otelUserPassword|harborAdminPassword|totpVaultKey|kimaiAppSecret|kimaiAdminPassword|GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|GITHUB_PRIVATE_KEY|woosh|root_password|rspamd_password|pgdb_password|matrix_access_token|pgdb_remote_url|hmac_secret_key|adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|smtp_auth_password|addresses|smtp_auth_username|authorization_credentials|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|integration_key|rootPassword|adminPassword|adminUser|adminEmail|emailPassword|secretKey|appId|clientSecret|webhookSecret)$
version: 3.9.1
