apiVersion: v1
kind: ServiceAccount
metadata:
  name: hf-chat-ui-vso
  namespace: hf-chat-ui
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: hf-chat-ui
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: hf-chat-ui
    serviceAccount: hf-chat-ui-vso
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: hf-chat-ui-oidc
  namespace: hf-chat-ui
spec:
  type: kv-v2
  mount: secret
  path: hf-chat-ui/oidc/zitadel
  destination:
    name: hf-chat-ui-oidc
    create: true
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: hf-chat-ui
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: hf-chat-ui-ca
  namespace: hf-chat-ui
spec:
  type: kv-v2
  mount: secret
  path: ca/internal
  hmacSecretData: true
  destination:
    name: ca-internal
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        ca.crt:
          text: >-
            {{- $ca := get .Secrets "certificate" -}}
            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
            {{- fail "CA publication is pending" -}}
            {{- end -}}
            {{- $ca -}}
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: hf-chat-ui
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: hf-chat-ui-pg-ca
  namespace: hf-chat-ui
spec:
  type: kv-v2
  mount: secret
  path: ca/postgres
  hmacSecretData: true
  destination:
    name: ca-postgres
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        ca.crt:
          text: >-
            {{- $ca := get .Secrets "certificate" -}}
            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
            {{- fail "CA publication is pending" -}}
            {{- end -}}
            {{- $ca -}}
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: hf-chat-ui
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: hf-chat-ui-db
  namespace: hf-chat-ui
spec:
  mount: database
  path: static-creds/hf-chat-ui
  allowStaticCreds: true
  refreshAfter: 5m
  destination:
    name: hf-chat-ui-db
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        POSTGRES_URL:
          text: postgresql://{{ get .Secrets "username" | urlquery }}:{{ get .Secrets "password" | urlquery }}@main-rw.postgres.svc.cluster.local:5432/hf_chat_ui?uselibpqcompat=true&sslmode=verify-full&sslrootcert=/var/run/certs/postgres-ca.crt
  rolloutRestartTargets:
    - kind: Deployment
      name: hf-chat-ui
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: quay-cluster-pull
  namespace: hf-chat-ui
spec:
  type: kv-v2
  mount: secret
  path: quay/robots/cluster_pull
  destination:
    name: quay-cluster-pull
    create: true
    overwrite: true
    type: kubernetes.io/dockerconfigjson
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        .dockerconfigjson:
          text: >-
            {"auths":{"registry.quorate.internal":{"auth":"{{ printf "%s:%s" (get .Secrets "username") (get .Secrets "token") | b64enc }}"}}}
  refreshAfter: 1h
  rolloutRestartTargets:
    - kind: Deployment
      name: hf-chat-ui
  vaultAuthRef: default