# Materializes a docker-registry pull secret (gitea-registry) from OpenBao via the existing
# ClusterSecretStore, so the private Gitea package can be pulled by k3s without a static secret
# in Git. Store a read:package Gitea PAT in OpenBao at `cluster/bluecap-registry` with fields
# `username` (e.g. bmr_bluecap) and `password` (the token).
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitea-registry
  namespace: bluecap-strategies
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: openbao-cluster
    kind: ClusterSecretStore
  target:
    name: gitea-registry
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: |
          {"auths":{"git.7tl-homelab.com":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
  data:
    - secretKey: username
      remoteRef: { key: bluecap-registry, property: username }
    - secretKey: password
      remoteRef: { key: bluecap-registry, property: password }