apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: docker-registry-basic-auth
spec:
  vaultAuthRef: vault-auth-storage
  mount: secret
  type: kv-v2
  path: docker-registry/basic-auth
  refreshAfter: 60s
  destination:
    name: docker-registry-basic-auth
    create: true
    overwrite: true
    labels:
      app.kubernetes.io/name: docker-registry
      app.kubernetes.io/component: registry
      app.kubernetes.io/managed-by: vault-secrets-operator
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        users:
          text: '{{ .Secrets.users }}'
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: docker-registry-pull-credentials
spec:
  vaultAuthRef: vault-auth-storage
  mount: secret
  type: kv-v2
  path: docker-registry/basic-auth
  refreshAfter: 60s
  destination:
    name: docker-registry-pull-credentials
    create: true
    overwrite: true
    type: kubernetes.io/dockerconfigjson
    labels:
      app.kubernetes.io/name: docker-registry
      app.kubernetes.io/component: registry
      app.kubernetes.io/managed-by: vault-secrets-operator
    transformation:
      excludeRaw: true
      templates:
        .dockerconfigjson:
          text: |
            {
              "auths": {
                "registry.project.com": {
                  "username": "{{ .Secrets.username }}",
                  "password": "{{ .Secrets.password }}",
                  "auth": "{{ printf "%s:%s" .Secrets.username .Secrets.password | b64enc }}"
                }
              }
            }