ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
--- a/services/mirrored-image/k8s/vso.yaml
+++ b/services/mirrored-image/k8s/vso.yaml
@ -0,0 +1,167 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata: {name: candidates-reader, namespace: mirrored-image}
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes: {role: candidates-reader, serviceAccount: cand-read-vso}
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata: {name: candidates-writer, namespace: mirrored-image}
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes: {role: candidates-writer, serviceAccount: cand-write-vso}
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata: {name: mirror-reader, namespace: mirrored-image}
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes: {role: mirror-reader, serviceAccount: mirror-read-vso}
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata: {name: mirror-writer, namespace: mirrored-image}
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes: {role: mirror-writer, serviceAccount: mirror-write-vso}
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata: {name: mirror-support, namespace: mirrored-image}
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes: {role: mirror-support, serviceAccount: mirror-sup-vso}
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: candidates-reader, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/oauth/candidates-reader
+  refreshAfter: 5m
+  destination:
+    name: candidates-reader
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        token: {text: '{{ get .Secrets "token" }}'}
+  rolloutRestartTargets:
+    - {kind: Deployment, name: mirrored-image}
+  vaultAuthRef: candidates-reader
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: candidates-writer, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/oauth/candidates-writer
+  refreshAfter: 5m
+  destination:
+    name: candidates-writer
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        token: {text: '{{ get .Secrets "token" }}'}
+  vaultAuthRef: candidates-writer
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: mirror-reader, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/oauth/mirror-reader
+  refreshAfter: 5m
+  destination:
+    name: mirror-reader
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        token: {text: '{{ get .Secrets "token" }}'}
+  rolloutRestartTargets:
+    - {kind: Deployment, name: mirrored-image}
+  vaultAuthRef: mirror-reader
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: mirror-writer, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/oauth/mirror-writer
+  refreshAfter: 5m
+  destination:
+    name: mirror-writer
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        token: {text: '{{ get .Secrets "token" }}'}
+  vaultAuthRef: mirror-writer
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: mirror-ca, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: argo/artifacts
+  refreshAfter: 1h
+  destination:
+    name: mirror-ca
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        ca.crt: {text: '{{ get .Secrets "internal_ca_cert" }}'}
+  rolloutRestartTargets:
+    - {kind: Deployment, name: mirrored-image}
+  vaultAuthRef: mirror-support
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata: {name: quay-cluster-pull, namespace: mirrored-image}
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  refreshAfter: 1h
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  vaultAuthRef: mirror-support