From 604ad362bd2eb2c4b285561f9f06a03abb790eb4 Mon Sep 17 00:00:00 2001
From: CMGS <ilskdw@gmail.com>
Date: Wed, 1 Jul 2026 16:59:16 +0800
Subject: [PATCH] fix(operator): make manager Deployment OCI-only

Replace the stale EPOCH_URL env with OCI_REGISTRY and wire GCP ADC auth
for Artifact Registry so the OCI-only operator can start. Mount the
cocoon-ar-writer-key Secret and point GOOGLE_APPLICATION_CREDENTIALS at
it for artifactregistry.writer access.
---
 config/manager/deployment.yaml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/config/manager/deployment.yaml b/config/manager/deployment.yaml
index a73c2e6..2f0b58a 100644
--- a/config/manager/deployment.yaml
+++ b/config/manager/deployment.yaml
@@ -29,8 +29,10 @@ spec:
           env:
             - name: OPERATOR_LOG_LEVEL
               value: info
-            - name: EPOCH_URL
-              value: http://epoch.cocoon-system.svc:8080
+            - name: OCI_REGISTRY
+              value: asia-southeast1-docker.pkg.dev/simular-note/cocoon-artifacts
+            - name: GOOGLE_APPLICATION_CREDENTIALS
+              value: /var/run/secrets/gcp/key.json
           ports:
             - name: metrics
               containerPort: 8080
@@ -57,3 +59,11 @@ spec:
             limits:
               cpu: 1000m
               memory: 512Mi
+          volumeMounts:
+            - name: gcp-ar-writer-key
+              mountPath: /var/run/secrets/gcp
+              readOnly: true
+      volumes:
+        - name: gcp-ar-writer-key
+          secret:
+            secretName: cocoon-ar-writer-key