Secrets are hard

Dockerfile

@@ -8,9 +8,9 @@ RUN apk add --no-cache python3 py-pip openssl ca-certificates bash git sudo zip
     && apk --no-cache add sshpass openssh-client \
     && apk del build-dependencies
     
-RUN addgroup -S ansible &&  adduser -S ansible -G ansible
-USER ansible
-WORKDIR /home/ansible
+RUN addgroup -S jenkins &&  adduser -S jenkins -G jenkins && mkdir -p /home/jenkins/agent
+USER jenkins
+WORKDIR /home/jenkins/agent
 
 CMD ["ansible-playbook", "--version"]
 

Jenkinsfile

@@ -1,7 +1,7 @@
 #!/usr/bin/env groovy
 
 podLabel = "image-build-${UUID.randomUUID()}"
-containerRegistry = 'docker.home.thejimnicholson.com/ansible-playbook-runner'
+containerRegistry = 'cr.thejimnicholson.com/tjn'
 containerImage = 'ansible-playbook-runner'
 
 podTemplate(label: podLabel, containers: [
@@ -11,7 +11,8 @@ podTemplate(label: podLabel, containers: [
     command: 'sleep',
     args: '30d'
   )
-], workspaceVolume: dynamicPVC()) {
+], volumes: [secretVolume(secretName: 'cr-regcred', mountPath: '/kaniko/.docker')],
+workspaceVolume: dynamicPVC()) {
   node(podLabel) {
     stage('Checkout') {
       checkout scm
@@ -30,7 +31,7 @@ podTemplate(label: podLabel, containers: [
               --insecure \
               --skip-tls-verify \
               --tarPath ./${containerImage}-${GIT_TAG}.image.tar \
-              --destination=${containerRegistry}/${containerImage}:${GIT_HASH} \
+              --destination=${containerRegistry}/${containerImage}:${GIT_TAG} \
               --destination=${containerRegistry}/${containerImage}:latest"
         }
       }