FEAT(external-secrets): add ClusterExternalSecret for Zot

- Add zot-registry-credentials ClusterExternalSecret
- Auto-create dockerconfigjson in labeled namespaces
- API version v1 (v1beta1 deprecated)

external-secrets/argocd.yaml

@@ -24,6 +24,9 @@ spec:
   - repoURL: https://github.com/K3S-HOME/security.git
     targetRevision: main
     ref: values
+  - repoURL: https://github.com/K3S-HOME/security.git
+    targetRevision: main
+    path: external-secrets/manifests
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets

external-secrets/manifests/kustomization.yaml

@@ -1,3 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: []
+resources:
+  - zot-cluster-secret.yaml

external-secrets/manifests/zot-cluster-secret.yaml

@@ -0,0 +1,31 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterExternalSecret
+metadata:
+  name: zot-registry-credentials
+spec:
+  externalSecretName: zot-registry-credentials
+  namespaceSelector:
+    matchLabels:
+      zot-registry: enabled
+  refreshTime: 1h
+  externalSecretSpec:
+    secretStoreRef:
+      kind: ClusterSecretStore
+      name: vault-backend
+    target:
+      name: zot-registry-credentials
+      creationPolicy: Owner
+      template:
+        type: kubernetes.io/dockerconfigjson
+        data:
+          .dockerconfigjson: |
+            {"auths":{"zot0213.kro.kr":{"username":"{{ .USERNAME }}","password":"{{ .PASSWORD }}","auth":"{{ printf "%s:%s" .USERNAME .PASSWORD | b64enc }}"}}}
+    data:
+      - secretKey: USERNAME
+        remoteRef:
+          key: zot
+          property: USERNAME
+      - secretKey: PASSWORD
+        remoteRef:
+          key: zot
+          property: PASSWORD