# registry-pull-secret — credentials for registry.neuralplatform.ai
# pulled from Vault by ESO. Lets the deployment fetch
# registry.neuralplatform.ai/neuron-web:* without baking creds into the manifest.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: registry-pull-secret
  namespace: neuron-web
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: registry-pull-secret
    creationPolicy: Owner
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: |
          {"auths":{"registry.neuralplatform.ai":{"username":"{{ .registry_user }}","password":"{{ .registry_docker_token }}","auth":"{{ list .registry_user .registry_docker_token | join ":" | b64enc }}"}}}
  data:
    - secretKey: registry_user
      remoteRef:
        key: secret/data/mudcraft
        property: registry_user
    - secretKey: registry_docker_token
      remoteRef:
        key: secret/data/mudcraft
        property: registry_docker_token