mirror of
https://github.com/external-secrets/external-secrets.git
synced 2024-12-14 11:57:59 +00:00
51fabd49a5
The old example used a `refreshInterval` value of 12h for the ACR access token. This change reduces that to 3h instead, since that is the expiration time for Service Principal authentication tokens: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli#service-principal Service principals are not the only way to authenticate towards ACR. In fact, two other ways (`managedIdentity` and `workloadIdentity`) are also outlined in the docs. I was unable to find any documentation in Azure for the default expiration time for those tokens, so as far as I know it is always 3 hours. Thus I think we should reflect this in our examples. Signed-off-by: Andreas Lindhé <7773090+lindhe@users.noreply.github.com>
29 lines
671 B
YAML
29 lines
671 B
YAML
{% raw %}
|
|
|
|
apiVersion: external-secrets.io/v1beta1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: azurecr-credentials
|
|
spec:
|
|
dataFrom:
|
|
- sourceRef:
|
|
generatorRef:
|
|
apiVersion: generators.external-secrets.io/v1alpha1
|
|
kind: ACRAccessToken
|
|
name: my-azurecr
|
|
refreshInterval: 3h
|
|
target:
|
|
name: azurecr-credentials
|
|
template:
|
|
type: kubernetes.io/dockerconfigjson
|
|
data:
|
|
.dockerconfigjson: |
|
|
{
|
|
"auths": {
|
|
"myregistry.azurecr.io": {
|
|
"username": "{{ .username }}",
|
|
"password": "{{ .password }}"
|
|
}
|
|
}
|
|
}
|
|
{% endraw %}
|