# imagePullSecret for demo-go-app's own Deployment — separate from
# harbor-robot-dockerconfig (which lives in the jenkins namespace, for
# the build pod's docker push). This one lands in the demo-go-app
# namespace itself, since imagePullSecrets must be in the same namespace
# as the pod referencing them. Same underlying robot account/Vault path
# (harbor/jenkins-robot already has push+pull scope), just synced to a
# second namespace and keyed to the same Contour ingress hostname used
# for the image reference in values/demo-go-app/demo-go-app/values.yaml.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: demo-go-app-image-pull-secret
  namespace: demo-go-app
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: demo-go-app-image-pull-secret
    creationPolicy: Owner
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: |
          {"auths":{"harbor.192.168.1.7.nip.io":{"username":"{{ .username }}","password":"{{ .password }}","auth":"{{ printf "%s:%s" .username .password | b64enc }}"}}}
  data:
    - secretKey: username
      remoteRef:
        key: harbor/jenkins-robot
        property: username
    - secretKey: password
      remoteRef:
        key: harbor/jenkins-robot
        property: password