Add a DockerHub credential to avoid API rate limit in Kubernetes

[dduportal]

This issue is about adding a DockerHub credential as namespaced secrets in Kubernetes when we have API rate limit blocking pod startups.

Reference of "old" issues with this root problem:

• [INFRA-3099] ci.jenkins.io: Only use High Memory instance when it's needed #2648
• [INFRA-3036] DockerHub API Rate Limit slows down builds on ci.jenkins.io + increases costs #2589

The scope of this issue, for now, is the following:

• Kubernetes clusters where there is a lot of autoscaling (up and down) e.g. used for Jenkins agents for ci.jenkins.io
• With Docker images hosted on the DockerHub

=> It means the clusters cik8s and doks

=> Short term fix is already done, to manually define the credential for Jenkins agents. Alas we discovered that datadog helm charts are often failing due to API rate limit, because we use a customized docker image hosted in the DockerHub under the name jenkinsciinfra/datadog as per the current "common" datadog configuration for all clusters

Task list:

• Generate a DockerHub account (ensuring that any token leaks would not allow injecting content into jenkinsciinfra/ or jenkins/ DockerHub namespace)
  • Username is cijenkinsioinfra, the recovery email is the private jenkins-infra mailing list
• Short term fix for Jenkins agents: manually create the credential, following https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/, in each namespace jenkins-agents of each cluster with pods failing to start due to API rate limit, under the name dockerhub-credential
• Configure the ci.jenkins.io kubernetes agents to use this credential as an imagePullSecret: https://github.com/jenkins-infra/jenkins-infra/pull/2066/files
• Create a Helm chart to allow inserting the credential in a given namespace, from values: feat: add helm chart for docker registry secrets helm-charts#97
• Install the helm chart docker-registry-secrets on the namespaces jenkins-agents and datadog on the 2 clusters, with the credential defined once in SOPS and passed as a helm values through the secrets: directive of helmfile
• Configure datadog chart to use this credentials (wip in docker hub credential secret for datadog in cik8s kubernetes-management#2018)

[smerle33]

(edited) might be related with #2837

[dduportal]

Closing as this issue is finished.