# Docker registry credentials for Jenkins to push to Harbor, as a proper
# kubernetes.io/dockerconfigjson secret (not a plain Opaque one) so it can
# be mounted straight at ~/.docker/config.json in the build container —
# docker push/pull read that format natively, no explicit `docker login`
# step needed in the pipeline itself.
#
# Vault-backed, same pattern as everything else. Put the robot account's
# credentials in first (create it in the Harbor UI: your CI project ->
# Robot Accounts -> New Robot Account, scoped to push+pull on that one
# project — Harbor shows the secret once, copy it immediately):
#   kubectl -n vault exec -i vault-0 -- vault kv put secret/harbor/jenkins-robot \
#     username='robot$<project>+<robot-name>' \
#     password='<the generated secret>'
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: harbor-robot-dockerconfig
  namespace: jenkins
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: harbor-robot-dockerconfig
    creationPolicy: Owner
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: |
          {"auths":{"harbor-core.harbor.svc.cluster.local":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
  data:
    - secretKey: username
      remoteRef:
        key: harbor/jenkins-robot
        property: username
    - secretKey: password
      remoteRef:
        key: harbor/jenkins-robot
        property: password