From 67347bdcdf353e6715d4f8a4de32612cb2721dce Mon Sep 17 00:00:00 2001
From: Will Anderson <will@neuralplatform.ai>
Date: Wed, 1 Apr 2026 00:10:00 -0500
Subject: [PATCH] feat(mudcraft): add registry pull secret and imagePullSecrets
 to deployment

---
 .../legion/k8s/mudcraft/deployment-core.yaml  |  2 ++
 .../mudcraft/external-secret-registry.yaml    | 27 +++++++++++++++++++
 2 files changed, 29 insertions(+)
 create mode 100644 servers/legion/k8s/mudcraft/external-secret-registry.yaml

diff --git a/servers/legion/k8s/mudcraft/deployment-core.yaml b/servers/legion/k8s/mudcraft/deployment-core.yaml
index e3d0064..251089e 100644
--- a/servers/legion/k8s/mudcraft/deployment-core.yaml
+++ b/servers/legion/k8s/mudcraft/deployment-core.yaml
@@ -15,6 +15,8 @@ spec:
       labels:
         app: mudcraft-core
     spec:
+      imagePullSecrets:
+        - name: registry-pull-secret
       containers:
         - name: mudcraft-core
           image: registry.neuralplatform.ai/mudcraft/core:3c5445c55d4e2afe2b4a5e6e4f4ce23e5e3bf374
diff --git a/servers/legion/k8s/mudcraft/external-secret-registry.yaml b/servers/legion/k8s/mudcraft/external-secret-registry.yaml
new file mode 100644
index 0000000..5a5ec30
--- /dev/null
+++ b/servers/legion/k8s/mudcraft/external-secret-registry.yaml
@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: registry-pull-secret
+  namespace: mudcraft
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: registry-pull-secret
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: |
+          {"auths":{"registry.neuralplatform.ai":{"username":"{{ .registry_user }}","password":"{{ .registry_docker_token }}","auth":"{{ list .registry_user .registry_docker_token | join ":" | b64enc }}"}}}
+  data:
+    - secretKey: registry_user
+      remoteRef:
+        key: secret/data/mudcraft
+        property: registry_user
+    - secretKey: registry_docker_token
+      remoteRef:
+        key: secret/data/mudcraft
+        property: registry_docker_token