apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: model-s3
  namespace: frigate
spec:
  type: kv-v2
  mount: secret
  path: versitygw/users/model-reader
  destination:
    name: model-s3
    create: true
  refreshAfter: 1h
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: frigate-ca
  namespace: frigate
spec:
  mount: pki
  path: cert/ca
  requestHTTPMethod: GET
  destination:
    name: frigate-ca
    create: true
    transformation:
      excludeRaw: true
      excludes: [.*]
      templates:
        ca.crt:
          text: '{{ get .Secrets "certificate" }}'
  refreshAfter: 1h
  vaultAuthRef: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: frigate-vso
  namespace: frigate
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: frigate
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: frigate
    serviceAccount: frigate-vso
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: frigate-oauth2-proxy
  namespace: frigate
spec:
  type: kv-v2
  mount: secret
  path: frigate/oauth2-proxy
  destination:
    name: frigate-oauth2-proxy
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        OAUTH2_PROXY_CLIENT_SECRET:
          text: '{{ get .Secrets "client_secret" }}'
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: frigate-oauth2-proxy
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: frigate-oauth2-proxy-cookie
  namespace: frigate
spec:
  type: kv-v2
  mount: secret
  path: frigate/oauth2-proxy-cookie
  destination:
    name: frigate-oauth2-proxy-cookie
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        OAUTH2_PROXY_COOKIE_SECRET:
          text: '{{ get .Secrets "cookie_secret" }}'
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: frigate-oauth2-proxy
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: frigate-config
  namespace: frigate
spec:
  type: kv-v2
  mount: secret
  path: frigate/rtsp
  destination:
    name: frigate-config
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        FRIGATE_RTSP_ADDRESS:
          text: '{{ get .Secrets "address" }}'
        FRIGATE_RTSP_PASSWORD:
          text: '{{ get .Secrets "password" }}'
        config.yaml:
          text: |
            mqtt:
              enabled: false

            audio:
              enabled: false

            tls:
              enabled: false

            auth:
              enabled: false

            proxy:
              default_role: viewer
              logout_url: /oauth2/sign_out
              header_map:
                user: x-forwarded-email
                role: x-forwarded-groups
                role_map:
                  admin:
                    - frigate_admin
                  viewer:
                    - frigate_viewer

            ffmpeg:
              hwaccel_args: preset-nvidia

            cameras:
              "********":
                enabled: true
                ffmpeg:
                  inputs:
                    - path: rtsp://********:{FRIGATE_RTSP_PASSWORD}@{FRIGATE_RTSP_ADDRESS}/stream1
                      input_args: preset-rtsp-generic
                      roles:
                        - detect
                        - record
                detect:
                  enabled: true
                  width: 1280
                  height: 720

            record:
              enabled: true
              continuous:
                days: 7

            detect:
              enabled: true

            detectors:
              onnx:
                type: onnx

            model:
              model_type: yolo-generic
              width: 320
              height: 320
              input_tensor: nchw
              input_dtype: float
              path: /config/model_cache/yolov9-t-320.onnx
              labelmap_path: /labelmap/coco-80.txt

            version: 0.18-0
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: frigate
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: quay-cluster-pull
  namespace: frigate
spec:
  type: kv-v2
  mount: secret
  path: quay/robots/cluster_pull
  destination:
    name: quay-cluster-pull
    create: true
    overwrite: true
    type: kubernetes.io/dockerconfigjson
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        .dockerconfigjson:
          text: >-
            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: frigate
  vaultAuthRef: default