From c44f82434dd21061fedffeff13a83e7d018b8718 Mon Sep 17 00:00:00 2001
From: Yury Kovalev <ykovalev@redhat.com>
Date: Mon, 2 Dec 2024 17:20:09 +0100
Subject: [PATCH] ROX-27209: Change image pull secret for operator deployments

---
 .../fleetshard-operator/07-serviceaccount.yaml |  2 --
 .../fleetshard-operator/51-fleetshard-cr.yaml  |  3 +--
 .../01-fleetshard-sync-secrets.yaml            |  2 --
 dev/env/scripts/bootstrap.sh                   |  1 -
 dev/env/scripts/create-imagepullsecrets        | 18 ++----------------
 dev/env/scripts/up.sh                          |  2 +-
 .../rhacs-operator-service-account.yaml        |  2 +-
 7 files changed, 5 insertions(+), 25 deletions(-)

diff --git a/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml b/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
index 1354cc2c45..a07ba2d295 100644
--- a/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
+++ b/dev/env/manifests/fleetshard-operator/07-serviceaccount.yaml
@@ -3,5 +3,3 @@ kind: ServiceAccount
 metadata:
   name: acs-fleetshard-operator
   namespace: "$ACSCS_NAMESPACE"
-imagePullSecrets:
-  - name: acs-fleetshard-operator
diff --git a/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml b/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
index 1a1d59d1cd..fbcc224201 100644
--- a/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
+++ b/dev/env/manifests/fleetshard-operator/51-fleetshard-cr.yaml
@@ -29,8 +29,7 @@ spec:
     secretEncryption:
       type: "local"
     tenantImagePullSecret:
-      name: "fleetshard-sync"
-      key: "tenant-image-pull-secret"
+      name: $TENANT_IMAGE_PULL_SECRET
     nodeSelector: null
     tolerations: null
     addonAutoUpgradeEnabled: false
diff --git a/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml b/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
index 20c70ca5de..a0ea54f109 100644
--- a/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
+++ b/dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
@@ -8,8 +8,6 @@ stringData:
   aws-access-key-id: "${AWS_ACCESS_KEY_ID}"
   aws-secret-access-key: "${AWS_SECRET_ACCESS_KEY}"
   telemetry-storage-key: "${TELEMETRY_STORAGE_KEY}"
-  tenant-image-pull-secret: |
-    ${TENANT_IMAGE_PULL_SECRET}
 ---
 apiVersion: v1
 kind: Secret
diff --git a/dev/env/scripts/bootstrap.sh b/dev/env/scripts/bootstrap.sh
index f8f1dd89c6..f80bbe6ac7 100755
--- a/dev/env/scripts/bootstrap.sh
+++ b/dev/env/scripts/bootstrap.sh
@@ -38,7 +38,6 @@ wait_for_default_service_account "$ACSCS_NAMESPACE"
 if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then
     create-imagepullsecrets
     inject_ips "$ACSCS_NAMESPACE" "default" "quay-ips"
-    inject_ips "$STACKROX_OPERATOR_NAMESPACE" "default" "quay-ips"
 else
     log "Skipping creation of ImagePullSecrets because INHERIT_IMAGEPULLSECRETS is not true"
 fi
diff --git a/dev/env/scripts/create-imagepullsecrets b/dev/env/scripts/create-imagepullsecrets
index 4c1c8c55d6..c16e4888fa 100755
--- a/dev/env/scripts/create-imagepullsecrets
+++ b/dev/env/scripts/create-imagepullsecrets
@@ -69,7 +69,7 @@ function print_auth() {
 
 registry_auth="$(print_auth "$(mkauth "${username}" "${password}")")"
 
-log "Creating quay-ips image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
+log "Creating rhacs-registry image pull secret in namespace ${STACKROX_OPERATOR_NAMESPACE}"
     resOperatorImage=$(
         cat <<EOF
 apiVersion: v1
@@ -77,7 +77,7 @@ data:
   .dockerconfigjson: ${registry_auth}
 kind: Secret
 metadata:
-  name: quay-ips
+  name: rhacs-registry
   namespace: ${STACKROX_OPERATOR_NAMESPACE}
 type: kubernetes.io/dockerconfigjson
 EOF
@@ -98,17 +98,3 @@ type: kubernetes.io/dockerconfigjson
 EOF
 )
 echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
-log "Creating acs-fleetshard-operator pull secret in namespace ${ACSCS_NAMESPACE}"
-res=$(
-    cat <<EOF
-apiVersion: v1
-data:
-  .dockerconfigjson: ${registry_auth}
-kind: Secret
-metadata:
-  name: acs-fleetshard-operator
-  namespace: $ACSCS_NAMESPACE
-type: kubernetes.io/dockerconfigjson
-EOF
-)
-echo "$res" | $KUBECTL -n "$ACSCS_NAMESPACE" apply -f -
diff --git a/dev/env/scripts/up.sh b/dev/env/scripts/up.sh
index d92f026040..160494408c 100755
--- a/dev/env/scripts/up.sh
+++ b/dev/env/scripts/up.sh
@@ -69,7 +69,7 @@ fi
 log "Deploying fleetshard-sync"
 TENANT_IMAGE_PULL_SECRET=""
 if [[ "$INHERIT_IMAGEPULLSECRETS" == "true" ]]; then # pragma: allowlist secret
-    TENANT_IMAGE_PULL_SECRET=$($KUBECTL -n "$ACSCS_NAMESPACE" get secret quay-ips -o jsonpath="{.data['\.dockerconfigjson']}" | base64 -d)
+    TENANT_IMAGE_PULL_SECRET="rhacs-registry" # pragma: allowlist secret
 fi
 export TENANT_IMAGE_PULL_SECRET
 
diff --git a/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml b/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
index b98fedce76..39d991e512 100644
--- a/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
+++ b/fleetshard/pkg/central/charts/data/rhacs-operator/templates/rhacs-operator-service-account.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ServiceAccount
 imagePullSecrets:
-  - name: acs-fleetshard-operator
+  - name: rhacs-registry
 metadata:
   name: rhacs-operator-controller-manager
   namespace: {{ .Release.Namespace }}