From c5834d2096406c43980dbb33e1be963a2a28f41f Mon Sep 17 00:00:00 2001
From: Yury Kovalev <ykovalev@redhat.com>
Date: Mon, 2 Dec 2024 17:20:09 +0100
Subject: [PATCH] ROX-27209: Change image pull secret for operator deployments

---
 .../fleetshard-operator/07-serviceaccount.yaml |  2 --
 .../fleetshard-operator/51-fleetshard-cr.yaml  |  3 +--
 .../01-fleetshard-sync-secrets.yaml            |  2 --
 dev/env/scripts/bootstrap.sh                   |  1 -
 dev/env/scripts/create-imagepullsecrets        | 18 ++----------------
 dev/env/scripts/up.sh                          |  6 ------
 dp-terraform/helm/rhacs-terraform/values.yaml  |  4 ++--
 .../rhacs-operator-service-account.yaml        |  2 +-
 fleetshard/pkg/central/operator/upgrade.go     |  3 ++-
 9 files changed, 8 insertions(+), 33 deletions(-)

diff --git a/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml b/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
index 1354cc2c45..a07ba2d295 100644
--- a/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
+++ b/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
@@ -3,5 +3,3 @@ kind: ServiceAccount
 metadata:
   name: acs-fleetshard-operator
   namespace: "$ACSCS_NAMESPACE"
-imagePullSecrets:
-  - name: acs-fleetshard-operator
diff --git a/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml b/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
index 1a1d59d1cd..5cc5decbe9 100644
--- a/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
+++ b/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
@@ -29,8 +29,7 @@ spec:
     secretEncryption:
       type: "local"
     tenantImagePullSecret:
-      name: "fleetshard-sync"
-      key: "tenant-image-pull-secret"
+      create: false # created by create-imagepullsecrets script
     nodeSelector: null
     tolerations: null
     addonAutoUpgradeEnabled: false
diff --git a/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml b/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
index 20c70ca5de..a0ea54f109 100644
--- a/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
+++ b/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
@@ -8,8 +8,6 @@ stringData:
   aws-access-key-id: "${AWS_ACCESS_KEY_ID}"
   aws-secret-access-key: "${AWS_SECRET_ACCESS_KEY}"
   telemetry-storage-key: "${TELEMETRY_STORAGE_KEY}"
-  tenant-image-pull-secret: |
-    ${TENANT_IMAGE_PULL_SECRET}
 ---
 apiVersion: v1
 kind: Secret
diff --git a/dev/env/scripts/bootstrap.sh b/dev/env/scripts/bootstrap.sh
index f8f1dd89c6..f80bbe6ac7 100755
--- a/dev/env/scripts/bootstrap.sh
+++ b/dev/env/scripts/bootstrap.sh
@@ -38,7 +38,6 @@ wait_for_default_service_account "$ACSCS_NAMESPACE"
 if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then
     create-imagepullsecrets
     inject_ips "$ACSCS_NAMESPACE" "default" "quay-ips"
-    inject_ips "$STACKROX_OPERATOR_NAMESPACE" "default" "quay-ips"
 else
     log "Skipping creation of ImagePullSecrets because INHERIT_IMAGEPULLSECRETS is not true"
 fi
diff --git a/dev/env/scripts/create-imagepullsecrets b/dev/env/scripts/create-imagepullsecrets
index 4c1c8c55d6..c16e4888fa 100755
--- a/dev/env/scripts/create-imagepullsecrets
+++ b/dev/env/scripts/create-imagepullsecrets
@@ -69,7 +69,7 @@ function print_auth() {
 
 registry_auth="$(print_auth "$(mkauth "${username}" "${password}")")"
 
-log "Creating quay-ips image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
+log "Creating rhacs-registry image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
     resOperatorImage=$(
         cat <<EOF
 apiVersion: v1
@@ -77,7 +77,7 @@ data:
   .dockerconfigjson: ${registry_auth}
 kind: Secret
 metadata:
-  name: quay-ips
+  name: rhacs-registry
   namespace: ${STACKROX_OPERATOR_NAMESPACE}
 type: kubernetes.io/dockerconfigjson
 EOF
@@ -98,17 +98,3 @@ type: kubernetes.io/dockerconfigjson
 EOF
 )
 echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
-log "Creating acs-fleetshard-operator pull secret in namespace ${ACSCS_NAMESPACE}"
-res=$(
-    cat <<EOF
-apiVersion: v1
-data:
-  .dockerconfigjson: ${registry_auth}
-kind: Secret
-metadata:
-  name: acs-fleetshard-operator
-  namespace: $ACSCS_NAMESPACE
-type: kubernetes.io/dockerconfigjson
-EOF
-)
-echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
diff --git a/dev/env/scripts/up.sh b/dev/env/scripts/up.sh
index d92f026040..871dc46fcc 100755
--- a/dev/env/scripts/up.sh
+++ b/dev/env/scripts/up.sh
@@ -67,12 +67,6 @@ if [[ "$SPAWN_LOGGER" == "true" && -n "${LOG_DIR:-}" ]]; then
 fi
 
 log "Deploying fleetshard-sync"
-TENANT_IMAGE_PULL_SECRET=""
-if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then # pragma: allowlist secret
-    TENANT_IMAGE_PULL_SECRET=$($KUBECTL -n "$ACSCS_NAMESPACE" get secret quay-ips -o jsonpath="{.data['\.dockerconfigjson']}" | base64 -d)
-fi
-export TENANT_IMAGE_PULL_SECRET
-
 exec_fleetshard_sync.sh apply "${MANIFESTS_DIR}/fleetshard-sync"
 apply "${MANIFESTS_DIR}/fleetshard-operator"
 
diff --git a/dp-terraform/helm/rhacs-terraform/values.yaml b/dp-terraform/helm/rhacs-terraform/values.yaml
index 54fb8c2bd5..54b70251ea 100644
--- a/dp-terraform/helm/rhacs-terraform/values.yaml
+++ b/dp-terraform/helm/rhacs-terraform/values.yaml
@@ -62,9 +62,9 @@ fleetshardSync:
   addonAutoUpgradeEnabled: true
   addonName: acs-fleetshard
   tenantImagePullSecret:
-    name: ""
+    name: rhacs-registry
     key: .dockerconfigjson
-    create: false
+    create: true
   printCentralUpdateDiff: false
   argoCdNamespace: openshift-gitops
 
diff --git a/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml b/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
index b98fedce76..39d991e512 100644
--- a/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
+++ b/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 imagePullSecrets:
-  - name: acs-fleetshard-operator
+  - name: rhacs-registry
 metadata:
   name: rhacs-operator-controller-manager
   namespace: {{ .Release.Namespace }}
diff --git a/fleetshard/pkg/central/operator/upgrade.go b/fleetshard/pkg/central/operator/upgrade.go
index 86afcf2ac3..2e1dc0a297 100644
--- a/fleetshard/pkg/central/operator/upgrade.go
+++ b/fleetshard/pkg/central/operator/upgrade.go
@@ -4,6 +4,8 @@ package operator
 import (
 	"context"
 	"fmt"
+	"strings"
+
 	"github.com/golang/glog"
 	"github.com/stackrox/acs-fleet-manager/fleetshard/pkg/central/charts"
 	"helm.sh/helm/v3/pkg/chartutil"
@@ -12,7 +14,6 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	ctrlClient "sigs.k8s.io/controller-runtime/pkg/client"
-	"strings"
 )
 
 const (