fix(gitops): wire ghcr pull secret for postgresql stack

databases/postgresql/ghcr-pull-externalsecret.yaml

@@ -0,0 +1,28 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgresql-ghcr-pull
+  namespace: database
+spec:
+  refreshInterval: 1m
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-platform
+  target:
+    name: postgresql-ghcr-pull
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      engineVersion: v2
+      data:
+        .dockerconfigjson: |
+          {"auths":{"ghcr.io":{"username":"{{ .username }}","password":"{{ .token }}","auth":"{{ printf "%s:%s" .username .token | b64enc }}"}}}
+  data:
+    - secretKey: username
+      remoteRef:
+        key: database/ghcr-pull
+        property: username
+    - secretKey: token
+      remoteRef:
+        key: database/ghcr-pull
+        property: token

databases/postgresql/kustomization.yaml

@@ -5,6 +5,7 @@ resources:
   - oci-repository.yaml
   - helmrelease.yaml
   - externalsecret.yaml
+  - ghcr-pull-externalsecret.yaml
   - stunnel-externalsecret.yaml
   - stunnel-server-configmap.yaml
   - stunnel-server-deployment.yaml

databases/postgresql/stunnel-client-deployment.yaml

@@ -13,6 +13,8 @@ spec:
       labels:
         app: postgresql-stunnel-client
     spec:
+      imagePullSecrets:
+        - name: postgresql-ghcr-pull
       containers:
         - name: stunnel-client
           image: dweomer/stunnel:latest

databases/postgresql/stunnel-server-deployment.yaml

@@ -13,6 +13,8 @@ spec:
       labels:
         app: postgresql-stunnel-server
     spec:
+      imagePullSecrets:
+        - name: postgresql-ghcr-pull
       containers:
         - name: stunnel-server
           image: dweomer/stunnel:latest

databases/postgresql/values.yaml

@@ -6,6 +6,9 @@ image:
   tag: "17.9"
   pullPolicy: IfNotPresent
 
+imagePullSecrets:
+  - postgresql-ghcr-pull
+
 auth:
   username: postgres
   database: postgres