From 0f0bdf4f6c2e1cf2d8d23716ea949dd15ce7935b Mon Sep 17 00:00:00 2001
From: adam <me@adamksmith.xyz>
Date: Tue, 16 Jun 2026 19:56:01 +0000
Subject: [PATCH] k8s: add registry-cred VSS + imagePullSecrets after prereq
 check

Prereqs verified on the cluster: VSO 1.3.0 (transformation supported,
openbao-kubernetes VaultAuth healthy), MQTT egress to 10.5.30.3:1883 reachable
from a pod, target nodes untainted, registry requires auth. Add
registry-cred-vaultstaticsecret.yaml (secret/registry/nexus -> dockerconfigjson,
mirroring existing cluster pattern) and wire imagePullSecrets into the DaemonSet.
README updated with verified prereqs + apply order.
---
 k8s/README.md                            | 28 ++++++++++++++----------
 k8s/daemonset.yaml                       |  5 ++---
 k8s/registry-cred-vaultstaticsecret.yaml | 18 +++++++++++++++
 3 files changed, 36 insertions(+), 15 deletions(-)
 create mode 100644 k8s/registry-cred-vaultstaticsecret.yaml

diff --git a/k8s/README.md b/k8s/README.md
index 743af39..08ba23b 100644
--- a/k8s/README.md
+++ b/k8s/README.md
@@ -16,31 +16,35 @@ independent, exactly like the standalone hosts.
 - No SAS poller (no SES enclosures on these nodes). Consequence: host-drive
   entities have no ZFS pool label (no zfs_map producer).
 
-## Prereqs to verify before applying
+## Prereqs — verified 2026-06-16
 
-1. **Registry pull**: confirm the cluster can pull `docker.adamksmith.xyz/*`.
-   If it needs auth, sync a `regcred` into the `jbod-monitor` namespace and
-   uncomment `imagePullSecrets` in `daemonset.yaml`.
-2. **VSO**: `vault-secrets-operator-system/openbao-kubernetes` VaultAuth exists
-   (it does, per infra notes). Confirm the `transformation.templates` syntax
-   matches the installed VSO version.
-3. **MQTT egress**: pods must reach `10.5.30.3:1883` (EMQX).
+1. **Registry pull**: registry requires auth. `registry-cred-vaultstaticsecret.yaml`
+   syncs `secret/registry/nexus` → `docker-registry-cred` (dockerconfigjson),
+   referenced as `imagePullSecrets` in the DaemonSet. (Mirrors the cluster's
+   existing `*-registry-cred` pattern.)
+2. **VSO**: v1.3.0; `openbao-kubernetes` VaultAuth healthy; `transformation.templates`
+   supported. No existing VSS in the cluster uses transformation, so watch the
+   `jbod-mqtt` VSS status on first apply for template errors.
+3. **MQTT egress**: confirmed — a cluster pod reached `10.5.30.3:1883`.
+4. **Nodes**: pascal/currie/fermi are untainted → no tolerations needed.
 
 ## Apply order
 
 ```bash
 # 1. Label ONLY the intended nodes (do not blanket-label all workers):
 kubectl label node usco-dc-pascal usco-dc-currie usco-dc-fermi jbod-monitor=enabled
+#    (canary: label just usco-dc-fermi first)
 
 # 2. Namespace + DaemonSet:
 kubectl apply -f k8s/daemonset.yaml
 
-# 3. MQTT creds (VSO → Secret jbod-mqtt). Apply, then confirm it synced:
+# 3. Secrets (VSO → docker-registry-cred + jbod-mqtt). Apply, then confirm sync:
+kubectl apply -f k8s/registry-cred-vaultstaticsecret.yaml
 kubectl apply -f k8s/mqtt-vaultstaticsecret.yaml
-kubectl -n jbod-monitor get vaultstaticsecret jbod-mqtt    # SYNCED=True
-kubectl -n jbod-monitor get secret jbod-mqtt               # has MQTT_USERNAME/PASSWORD
+kubectl -n jbod-monitor get vaultstaticsecret           # SYNCED=True for both
+kubectl -n jbod-monitor get secret jbod-mqtt -o jsonpath='{.data.MQTT_USERNAME}' | base64 -d
 
-# 4. Roll the web container so it picks up the secret (if it started first):
+# 4. Roll the DaemonSet so pods pick up the secrets if they raced ahead:
 kubectl -n jbod-monitor rollout restart daemonset/jbod-monitor
 ```
 
diff --git a/k8s/daemonset.yaml b/k8s/daemonset.yaml
index 8f47d84..a64c46d 100644
--- a/k8s/daemonset.yaml
+++ b/k8s/daemonset.yaml
@@ -35,9 +35,8 @@ spec:
       # Only nodes explicitly opted in (see README: kubectl label node ...).
       nodeSelector:
         jbod-monitor: "enabled"
-      # If the registry needs auth, sync a regcred and uncomment:
-      # imagePullSecrets:
-      #   - name: regcred
+      imagePullSecrets:
+        - name: docker-registry-cred   # synced by registry-cred-vaultstaticsecret.yaml
       containers:
         - name: redis
           image: redis:7-alpine
diff --git a/k8s/registry-cred-vaultstaticsecret.yaml b/k8s/registry-cred-vaultstaticsecret.yaml
new file mode 100644
index 0000000..3afa97b
--- /dev/null
+++ b/k8s/registry-cred-vaultstaticsecret.yaml
@@ -0,0 +1,18 @@
+# Image pull secret for docker.adamksmith.xyz, synced by VSO from OpenBao.
+# Mirrors the cluster's existing *-registry-cred pattern (secret/registry/nexus
+# -> dockerconfigjson). Referenced as imagePullSecrets in the DaemonSet.
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: docker-registry-cred
+  namespace: jbod-monitor
+spec:
+  vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
+  mount: secret
+  path: registry/nexus
+  type: kv-v2
+  refreshAfter: 1h
+  destination:
+    name: docker-registry-cred
+    create: true
+    type: kubernetes.io/dockerconfigjson