feat(ISV-7583): update registry.redhat.io auth token

[JakubDurkac]

Set a new dedicated service account token.

[qodo-redhat-openshift-ecosystem]

PR Summary by Qodo

Rotate registry.redhat.io pull token in Ansible Vault (prod/stage)

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Rotate the registry.redhat.io auth token to a dedicated service account.
• Update the encrypted secrets payloads for both stage and prod vaults.
• Keep runtime behavior unchanged aside from using the new credentials.

Diagram

graph TD
A["Ansible deploy"] --> B["Vault secrets"] --> C["Registry auth config"] --> D{{"registry.redhat.io"}}
C --> E["Cluster nodes"]
subgraph Legend
  direction LR
  _proc["Process"] ~~~ _file["Encrypted file"] ~~~ _ext{{"External"}}
end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Move registry credentials to external secret manager

• ➕ Centralized rotation/audit (e.g., HashiCorp Vault/External Secrets Operator)
• ➕ Avoids committing rotated encrypted blobs to Git
• ➖ Requires additional infrastructure and operational ownership
• ➖ May require refactoring current Ansible secret consumption

2. Use per-cluster imagePullSecret managed at runtime

• ➕ Keeps credential lifecycle closer to the cluster platform (Kubernetes/OpenShift)
• ➕ Can decouple deployments from repository-stored secrets
• ➖ Needs a secure bootstrap/rotation process outside current Ansible flow
• ➖ Risk of drift between environments if not automated end-to-end

Recommendation: For immediate remediation, rotating the token in the existing Ansible Vault files is appropriate and low-risk. Longer-term, consider migrating registry credentials to an external secret manager or runtime-managed imagePullSecrets to reduce Git-based secret churn and improve rotation/auditing.

Files changed (2) +866 / -765

Other (2) +866 / -765

secrets.ymlRotate prod encrypted registry.redhat.io credentials +433/-383

Rotate prod encrypted registry.redhat.io credentials

• Updates the Ansible Vault-encrypted secret payload for production to use the new dedicated service account token for registry.redhat.io access. No plaintext structure can be reviewed due to encryption, but the change is isolated to the prod vault file.

ansible/vaults/prod/secrets.yml

secrets.ymlRotate stage encrypted registry.redhat.io credentials +433/-382

Rotate stage encrypted registry.redhat.io credentials

• Updates the Ansible Vault-encrypted secret payload for staging to use the new dedicated service account token for registry.redhat.io access. Keeps staging aligned with production by rotating the corresponding credential in the stage vault file.

ansible/vaults/stage/secrets.yml

[qodo-redhat-openshift-ecosystem]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[JakubDurkac]

I've deployed to stage and ran a job pulling registry.redhat.io/redhat/redhat-marketplace-index and seems good. On stage cluster, you can check namespace pullsar-stage, and compare logs of last two jobs in component pullsar-worker-redhat-marketplace-index. The last one suceeded while the one before has failed with the old token. cc @bclindner