---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: quay
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: quay
    serviceAccount: quay-vso
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: quay-config-bundle
  namespace: quay
spec:
  type: kv-v2
  mount: secret
  path: quay/secrets
  destination:
    name: quay-config-bundle
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        config.yaml:
          text: |
            AUTHENTICATION_TYPE: OIDC
            BROWSER_API_CALLS_XHR_ONLY: false
            DATABASE_SECRET_KEY: "{{ get .Secrets "database_secret_key" }}"
            DB_URI: "postgresql://********@main-rw.postgres.svc.cluster.local:5432/quay?sslmode=require"
            BUILDLOGS_REDIS:
              host: quay.dragonfly.svc.cluster.local
              password: "{{ get .Secrets "redis_password" }}"
              port: 6379
            DISTRIBUTED_STORAGE_CONFIG:
              default:
                - RadosGWStorage
                - access_key: quay
                  secret_key: "{{ get .Secrets "s3_secret_key" }}"
                  bucket_name: quay-registry
                  hostname: s3.quorate.internal
                  is_secure: true
                  signature_version: v4
                  storage_path: /datastorage/registry
                  server_side_assembly: false
            DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
            DISTRIBUTED_STORAGE_PREFERENCE: ["default"]
            EXTERNAL_TLS_TERMINATION: false
            FEATURE_SECURITY_NOTIFICATIONS: true
            FEATURE_SECURITY_SCANNER: true
            FEATURE_SECURITY_SCANNER_NOTIFY_ON_NEW_INDEX: true
            FEATURE_PROXY_CACHE: false
            FEATURE_USER_CREATION: true
            FEATURE_USER_INITIALIZE: true
            PREFERRED_URL_SCHEME: https
            SECRET_KEY: "{{ get .Secrets "secret_key" }}"
            SECURITY_SCANNER_INDEXING_INTERVAL: 30
            SECURITY_SCANNER_V4_ENDPOINT: http://quay-registry-clair-app.quay.svc.cluster.local
            SECURITY_SCANNER_V4_INDEX_MAX_LAYER_SIZE: 8G
            SECURITY_SCANNER_V4_MANIFEST_CLEANUP: true
            SECURITY_SCANNER_V4_PSK: "{{ get .Secrets "clair_psk" }}"
            SERVER_HOSTNAME: registry.quorate.internal
            SUPER_USERS: ["********"]
            USER_EVENTS_REDIS:
              host: quay.dragonfly.svc.cluster.local
              password: "{{ get .Secrets "redis_password" }}"
              port: 6379
            ZITADEL_LOGIN_CONFIG:
              CLIENT_ID: "{{ get .Secrets "oidc_client_id" }}"
              CLIENT_SECRET: "{{ get .Secrets "oidc_client_secret" }}"
              LOGIN_SCOPES: ["openid", "email", "profile"]
              OIDC_ISSUER: https://auth.quorate.dev
              OIDC_SERVER: https://auth.quorate.dev/
              PREFERRED_GROUP_CLAIM_NAME: groups
              PREFERRED_USERNAME_CLAIM_NAME: preferred_username
              SERVICE_NAME: Zitadel
        clair-config.yaml:
          text: |
            http_listen_addr: :8080
            introspection_addr: :8089
            log_level: info
            indexer:
              connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
              scanlock_retry: 10
              layer_scan_concurrency: 5
              migrations: true
              scanner:
                package:
                  java:
                    api: https://central.sonatype.com/solrsearch/select
            matcher:
              connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
              migrations: true
            notifier:
              connstring: "host=main-rw.postgres.svc.cluster.local port=5432 dbname=quay_clair user=******** sslmode=require"
              delivery_interval: 1m
              migrations: true
              poll_interval: 5m
              webhook:
                callback: http://quay-registry-clair-app/notifier/api/v1/notifications
                target: https://registry.quorate.internal/secscan/notification
            auth:
              psk:
                key: "{{ get .Secrets "clair_psk" }}"
                iss: ["quay", "clairctl"]
            updaters:
              config:
                rhel-vex:
                  ignore_unpatched: true
              sets:
                - alpine
                - clair.cvss
                - debian
                - oracle
                - photon
                - rhcc
                - rhel-vex
                - suse
                - ubuntu
            metrics:
              name: prometheus
        extra_ca_cert_internal-ca.crt:
          text: |
            {{- get .Secrets "internal_ca_cert" -}}
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: quay-registry-quay-app
    - kind: Deployment
      name: quay-registry-clair
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: quay-db
  namespace: quay
spec:
  mount: database
  path: static-creds/quay
  allowStaticCreds: true
  destination:
    name: quay-db
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        username:
          text: '{{ get .Secrets "username" }}'
        password:
          text: '{{ get .Secrets "password" }}'
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: quay-registry-quay-app
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: clair-db
  namespace: quay
spec:
  mount: database
  path: static-creds/quay_clair
  allowStaticCreds: true
  destination:
    name: clair-db
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        username:
          text: '{{ get .Secrets "username" }}'
        password:
          text: '{{ get .Secrets "password" }}'
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: quay-registry-clair
  vaultAuthRef: default

---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: quay-cluster-pull
  namespace: quay
spec:
  type: kv-v2
  mount: secret
  path: quay/robots/cluster_pull
  refreshAfter: 1h
  destination:
    name: quay-cluster-pull
    create: true
    overwrite: true
    type: kubernetes.io/dockerconfigjson
    transformation:
      excludeRaw: true
      excludes: [.*]
      templates:
        .dockerconfigjson:
          text: >-
            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
  vaultAuthRef: default