45 lines
1.1 KiB
YAML
45 lines
1.1 KiB
YAML
|
apiVersion: v1
|
||
|
|
kind: ServiceAccount
|
||
|
|
metadata:
|
||
|
|
name: zot-vso
|
||
|
|
namespace: project-delivery
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
---
|
||
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
||
|
|
kind: VaultAuth
|
||
|
|
metadata:
|
||
|
|
name: zot
|
||
|
|
namespace: project-delivery
|
||
|
|
spec:
|
||
|
|
method: kubernetes
|
||
|
|
mount: kubernetes
|
||
|
|
kubernetes:
|
||
|
|
role: quay-custom-writer
|
||
|
|
serviceAccount: quay-custom-zot-vso
|
||
|
|
vaultConnectionRef: vault/vault
|
||
|
|
---
|
||
|
|
apiVersion: secrets.hashicorp.com/v1beta1
|
||
|
|
kind: VaultStaticSecret
|
||
|
|
metadata:
|
||
|
|
name: writer
|
||
|
|
namespace: project-delivery
|
||
|
|
spec:
|
||
|
|
type: kv-v2
|
||
|
|
mount: secret
|
||
|
|
path: zot/quay-custom
|
||
|
|
refreshAfter: 1h
|
||
|
|
destination:
|
||
|
|
name: quay-custom-writer
|
||
|
|
create: true
|
||
|
|
overwrite: true
|
||
|
|
type: kubernetes.io/dockerconfigjson
|
||
|
|
transformation:
|
||
|
|
excludeRaw: true
|
||
|
|
excludes: [.*]
|
||
|
|
templates:
|
||
|
|
.dockerconfigjson:
|
||
|
|
text: |
|
||
|
|
{{- $user := get .Secrets "username" -}}
|
||
|
|
{{- $password := get .Secrets "password" -}}
|
||
|
|
{"auths":{"zot.quorate.internal":{"username":"{{ $user }}","password":"{{ $password }}","auth":"{{ printf "%s:%s" $user $password | b64enc }}"}}}
|
||
|
|
vaultAuthRef: quay-custom-zot
|