Openshift/OKD - how to template docker secrets - openshift

Question

As a admin with a lot of parameterized Openshift Templates, I am struggling to create a parameterized SECRET objects in the templates for type kubernetes.io/dockerconfigjson or kubernetes.io/dockercfg so that the secret can be used for docker pulls.
Challenge:Everything is pre-base64 encoded in JSON format for normal dockerconfigjson template setup, and not sure how to change it.
The Ask: How to create a SECRET template that takes parameters ${DOCKER_USER}, ${DOCKER_PASSWORD}, ${DOCKER_SERVER}, and ${DOCKER_EMAIL} to then create the actual secret that can be used to pull docker images from a private/secured docker registry.
This is to replace commandline "oc create secret docker-registry ...." techniques by putting them in a template file stored within gitlab/github to have a gitOps style deployment pattern.
Thanks!

Answer 1

The format of the docker configuration secrets can be found in the documentation (or in your cluster via oc export secret/mysecret) under the Using Secrets section.
apiVersion: v1
kind: Secret
metadata:
name: aregistrykey
namespace: myapps
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson:<base64encoded docker-config.json>
One method would be to accept the pre-based64 encoded contents of the json file in your template parameters and stuff them into the data section.
apiVersion: v1
kind: Secret
metadata:
name: aregistrykey
namespace: myapps
type: kubernetes.io/dockerconfigjson
data:
.dockerconfigjson:${BASE64_DOCKER_JSON}
Another method would be to use the stringData field of the secret object. As noted on the same page:
Entries in the stringData map are converted to base64 and the entry will then be moved to the data map automatically. This field is write-only; the value will only be returned via the data field.
apiVersion: v1
kind: Secret
metadata:
name: aregistrykey
namespace: myapps
type: kubernetes.io/dockerconfigjson
stringData:
.dockerconfigjson:${REGULAR_DOCKER_JSON}
The format of the actual value of the .dockerconfigjson key is the same as the contents of the .docker/config.json file. So in your specific case you might do something like:
apiVersion: v1
kind: Secret
metadata:
name: aregistrykey
namespace: myapps
type: kubernetes.io/dockerconfigjson
stringData:
.dockerconfigjson:'{"auths": {"${REGISTRY_URL}": {"auth": "${BASE64_USERNAME_COLON_PASSWORD}"}}}'
Unfortunately the template langugage OpenShift uses for templates isn't quite powerful enough to base64 encode the actual paramter values for you, so you can't quite escape having to encode the username:password pair outside of the template itself, but your CI/CD tooling should be more than capable of performing this with raw username/password strings.