From 3f0abf3e8cab972f021514870aaed6ea337cf197 Mon Sep 17 00:00:00 2001
From: Kenny Hackworth <khackwor@rackspace.com>
Date: Thu, 17 Sep 2026 13:05:46 -0400
Subject: [PATCH] Configuring net dev creds import for openstack and
 argo-events

---
 components/ironic/values.yaml                 |   8 ++
 .../workflowtemplates/ansible-run.yaml        | 135 ++++++++++++++++++
 2 files changed, 143 insertions(+)

diff --git a/components/ironic/values.yaml b/components/ironic/values.yaml
index 198195dc4..daca5a7e3 100644
--- a/components/ironic/values.yaml
+++ b/components/ironic/values.yaml
@@ -265,6 +265,9 @@ pod:
           - name: ironic-inspection-rules
             mountPath: /etc/ironic/inspection-rules/
             readOnly: true
+          - name: network-device-credentials
+            mountPath: /etc/network-device-credentials
+            readOnly: true
         volumes:
           - name: dnsmasq-ironic
             persistentVolumeClaim:
@@ -279,6 +282,11 @@ pod:
             configMap:
               name: ironic-inspection-rules
               optional: true
+          - name: network-device-credentials
+            secret:
+              secretName: network-device-credentials
+              defaultMode: 0400
+              optional: true
   replicas:
     api: 4
     conductor: 1
diff --git a/workflows/argo-events/workflowtemplates/ansible-run.yaml b/workflows/argo-events/workflowtemplates/ansible-run.yaml
index 000ae5bc2..ff473ae3b 100644
--- a/workflows/argo-events/workflowtemplates/ansible-run.yaml
+++ b/workflows/argo-events/workflowtemplates/ansible-run.yaml
@@ -44,6 +44,141 @@ spec:
           secretKeyRef:
             name: nautobot-token
             key: url
+      # PAN-OS credentials (factory -> preconfig -> standard -> TACACS)
+      - name: PANOS_FACTORY_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_factory_username
+            optional: true
+      - name: PANOS_FACTORY_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_factory_password
+            optional: true
+      - name: PANOS_PRECONFIG_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_preconfig_username
+            optional: true
+      - name: PANOS_PRECONFIG_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_preconfig_password
+            optional: true
+      - name: PANOS_STANDARD_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_standard_username
+            optional: true
+      - name: PANOS_STANDARD_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: panos_standard_password
+            optional: true
+      # F5 credentials (factory -> preconfig -> standard -> TACACS)
+      - name: F5_FACTORY_ROOT_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_factory_root_username
+            optional: true
+      - name: F5_FACTORY_ROOT_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_factory_root_password
+            optional: true
+      - name: F5_FACTORY_ADMIN_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_factory_admin_username
+            optional: true
+      - name: F5_FACTORY_ADMIN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_factory_admin_password
+            optional: true
+      - name: F5_PRECONFIG_ROOT_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_preconfig_root_username
+            optional: true
+      - name: F5_PRECONFIG_ROOT_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_preconfig_root_password
+            optional: true
+      - name: F5_PRECONFIG_ADMIN_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_preconfig_admin_username
+            optional: true
+      - name: F5_PRECONFIG_ADMIN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_preconfig_admin_password
+            optional: true
+      - name: F5_STANDARD_ROOT_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_standard_root_username
+            optional: true
+      - name: F5_STANDARD_ROOT_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_standard_root_password
+            optional: true
+      - name: F5_STANDARD_ADMIN_USERNAME
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_standard_admin_username
+            optional: true
+      - name: F5_STANDARD_ADMIN_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: f5_standard_admin_password
+            optional: true
+      # TACACS credentials (A-side and B-side for redundancy)
+      - name: TACACS_USER_A
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: tacacs_user_a
+            optional: true
+      - name: TACACS_PASS_A
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: tacacs_pass_a
+            optional: true
+      - name: TACACS_USER_B
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: tacacs_user_b
+            optional: true
+      - name: TACACS_PASS_B
+        valueFrom:
+          secretKeyRef:
+            name: network-device-credentials
+            key: tacacs_pass_b
+            optional: true
       envFrom:
       - configMapRef:
           name: cluster-metadata