apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: ghcr-credentials
  namespace: styrene-infra
spec:
  vaultAuthRef: styrene-vault-auth
  mount: secret
  type: kv-v2
  path: bootstrap/ghcr/styrene-lab
  destination:
    name: ghcr-secret
    create: true
    type: kubernetes.io/dockerconfigjson
    transformation:
      excludeRaw: true
      templates:
        .dockerconfigjson:
          text: |
            {"auths":{"{{ .Secrets.server }}":{"username":"{{ .Secrets.username }}","password":"{{ .Secrets.password }}","auth":"{{ printf "%s:%s" .Secrets.username .Secrets.password | b64enc }}"}}}
  refreshAfter: 1h
