registry-external-secret.yaml

{{- $regAuth := or .Values.app.images.main.registry.auth (and .Values.global.registry.enabled .Values.global.registry.vaultPath) }}
{{- $regDomain := .Values.app.images.main.registry.domain | default .Values.global.registry.domain }}
{{- $regUser := .Values.app.images.main.registry.user | default .Values.global.registry.user }}
{{- $regVaultPath := .Values.app.images.main.registry.vaultPath | default .Values.global.registry.vaultPath }}
{{- $regPasswordKey := .Values.app.images.main.registry.passwordVaultKey | default .Values.global.registry.passwordVaultKey }}
{{- if $regAuth }}
---
apiVersion: "external-secrets.io/v1"
kind: ExternalSecret
metadata:
  name: {{ .Values.app.images.main.registry.secretName }}
  namespace: {{ .Release.Namespace | default .Values.global.namespace }}
  annotations:
    argocd.argoproj.io/sync-wave: "36"
spec:
  refreshInterval: 15s
  secretStoreRef:
    name: {{ .Values.global.secretStore.name }}
    kind: {{ .Values.global.secretStore.kind }}
  target:
    name: {{ .Values.app.images.main.registry.secretName }}
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: |
          {
            "auths": {
              "{{ tpl (required "registry domain is required (set app.images.main.registry.domain or global.registry.domain)" $regDomain) $ }}": {
                "auth": "{{ `{{ printf "%s:%s" "` }}{{ $regUser }}{{ `" .password | b64enc }}` }}"
              }
            }
          }
  data:
  - secretKey: password
    remoteRef:
      key: {{ required "registry vaultPath is required (set app.images.main.registry.vaultPath or global.registry.vaultPath)" $regVaultPath }}
      property: {{ required "registry passwordVaultKey is required (set app.images.main.registry.passwordVaultKey or global.registry.passwordVaultKey)" $regPasswordKey }}
{{- end }}