[shiftstack] Mount TRex SSH keypair secret into shiftstackclient pod

Add optional support for mounting a Kubernetes Secret containing SSH
keys into the shiftstackclient pod. When
cifmw_shiftstack_trex_keypair_secret is set, the secret is mounted
at /home/cloud-admin/trex-keypair/.

This is used by the NFV telco verification job to provide the TRex
traffic generator SSH key (created by Terraform) to the shiftstack-qa
automation running inside the pod, without relying on file system paths
on the hypervisor.

Signed-off-by: Ella Shulman <eshulman@redhat.com>
Assisted-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: eshulman2

roles/shiftstack/defaults/main.yml

@@ -51,3 +51,5 @@ cifmw_shiftstack_storage_access_mode:
 cifmw_shiftstack_extra_vars: {}
 cifmw_shiftstack_extra_vars_configmap_name: "shiftstack-extra-vars"
 cifmw_shiftstack_extra_vars_mount_path: "/home/cloud-admin/extra-vars"
+# Optional: name of a Kubernetes Secret containing SSH keys to mount into the pod
+# cifmw_shiftstack_trex_keypair_secret: "trex-keypair"

roles/shiftstack/templates/shiftstackclient_pod.yml.j2

@@ -47,6 +47,11 @@ spec:
     - name: extra-vars
       mountPath: {{ cifmw_shiftstack_extra_vars_mount_path }}
       readOnly: true
+{% endif %}
+{% if cifmw_shiftstack_trex_keypair_secret is defined %}
+    - name: trex-keypair
+      mountPath: /home/cloud-admin/trex-keypair
+      readOnly: true
 {% endif %}
   dnsPolicy: ClusterFirst
   enableServiceLinks: true
@@ -90,3 +95,9 @@ spec:
       defaultMode: 420
       name: {{ cifmw_shiftstack_extra_vars_configmap_name }}
 {% endif %}
+{% if cifmw_shiftstack_trex_keypair_secret is defined %}
+  - name: trex-keypair
+    secret:
+      defaultMode: 256
+      secretName: {{ cifmw_shiftstack_trex_keypair_secret }}
+{% endif %}