ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/frigate/vso.yaml

@@ -0,0 +1,228 @@
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: model-s3
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: versitygw/users/model-reader
+  destination:
+    name: model-s3
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: frigate-ca
+  namespace: frigate
+spec:
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  destination:
+    name: frigate-ca
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: frigate-vso
+  namespace: frigate
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: frigate
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: frigate
+    serviceAccount: frigate-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-oauth2-proxy
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/oauth2-proxy
+  destination:
+    name: frigate-oauth2-proxy
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        OAUTH2_PROXY_CLIENT_SECRET:
+          text: '{{ get .Secrets "client_secret" }}'
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate-oauth2-proxy
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-oauth2-proxy-cookie
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/oauth2-proxy-cookie
+  destination:
+    name: frigate-oauth2-proxy-cookie
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        OAUTH2_PROXY_COOKIE_SECRET:
+          text: '{{ get .Secrets "cookie_secret" }}'
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate-oauth2-proxy
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: frigate-config
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: frigate/rtsp
+  destination:
+    name: frigate-config
+    create: true
+    overwrite: true
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        FRIGATE_RTSP_ADDRESS:
+          text: '{{ get .Secrets "address" }}'
+        FRIGATE_RTSP_PASSWORD:
+          text: '{{ get .Secrets "password" }}'
+        config.yaml:
+          text: |
+            mqtt:
+              enabled: false
+
+            audio:
+              enabled: false
+
+            tls:
+              enabled: false
+
+            auth:
+              enabled: false
+
+            proxy:
+              default_role: viewer
+              logout_url: /oauth2/sign_out
+              header_map:
+                user: x-forwarded-email
+                role: x-forwarded-groups
+                role_map:
+                  admin:
+                    - frigate_admin
+                  viewer:
+                    - frigate_viewer
+
+            ffmpeg:
+              hwaccel_args: preset-nvidia
+
+            cameras:
+              "********":
+                enabled: true
+                ffmpeg:
+                  inputs:
+                    - path: rtsp://********:{FRIGATE_RTSP_PASSWORD}@{FRIGATE_RTSP_ADDRESS}/stream1
+                      input_args: preset-rtsp-generic
+                      roles:
+                        - detect
+                        - record
+                detect:
+                  enabled: true
+                  width: 1280
+                  height: 720
+
+            record:
+              enabled: true
+              continuous:
+                days: 7
+
+            detect:
+              enabled: true
+
+            detectors:
+              onnx:
+                type: onnx
+
+            model:
+              model_type: yolo-generic
+              width: 320
+              height: 320
+              input_tensor: nchw
+              input_dtype: float
+              path: /config/model_cache/yolov9-t-320.onnx
+              labelmap_path: /labelmap/coco-80.txt
+
+            version: 0.18-0
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: quay-cluster-pull
+  namespace: frigate
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/robots/cluster_pull
+  destination:
+    name: quay-cluster-pull
+    create: true
+    overwrite: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes:
+        - .*
+      templates:
+        .dockerconfigjson:
+          text: >-
+            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
+  refreshAfter: 1h
+  rolloutRestartTargets:
+    - kind: Deployment
+      name: frigate
+  vaultAuthRef: default