From caee4f8a010c86aaabf386d2a352b1030086522a Mon Sep 17 00:00:00 2001
From: eding <edin.grech@gmail.com>
Date: Wed, 19 Nov 2025 08:37:06 +0100
Subject: [PATCH] feat: ghcr external secret generator

---
 internal/k8s/external_secret.go | 54 +++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/internal/k8s/external_secret.go b/internal/k8s/external_secret.go
index d4acac9..458c997 100644
--- a/internal/k8s/external_secret.go
+++ b/internal/k8s/external_secret.go
@@ -76,6 +76,60 @@ func CheckExternalSecretCRD() error {
 	return nil
 }
 
+// CreateGhcrExternalSecret generates and applies the ExternalSecret for GHCR.
+func CreateGhcrExternalSecret() error {
+	fmt.Println("[INFO] Creating ExternalSecret for GHCR in 'flux-system' namespace...")
+
+	externalSecret := ExternalSecret{
+		ApiVersion: "external-secrets.io/v1",
+		Kind:       "ExternalSecret",
+		Metadata: Metadata{
+			Name:      "ghcr-auth",
+			Namespace: "flux-system",
+		},
+		Spec: ExternalSecretSpec{
+			SecretStoreRef: SecretStoreRef{
+				Name: "vault-backend",
+				Kind: "ClusterSecretStore",
+			},
+			Target: ExternalSecretTarget{
+				Name:           "ghcr-auth",
+				CreationPolicy: "Owner",
+				Template: ExternalSecretTemplate{
+					Type: "kubernetes.io/dockerconfigjson",
+					Data: map[string]string{
+						".dockerconfigjson": `{{ index . ".dockerconfigjson" | toString }}`,
+					},
+				},
+			},
+			Data: []ExternalSecretData{
+				{
+					SecretKey: ".dockerconfigjson",
+					RemoteRef: ExternalSecretDataRemoteRef{
+						Key:      vault.GhcrSecretPath,
+						Property: vault.DockerConfigJSONKey,
+					},
+				},
+			},
+		},
+	}
+
+	yamlData, err := yaml.Marshal(&externalSecret)
+	if err != nil {
+		return fmt.Errorf("failed to marshal ExternalSecret to YAML: %w", err)
+	}
+
+	cmd := exec.Command("kubectl", "apply", "-f", "-")
+	cmd.Stdin = bytes.NewReader(yamlData)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("failed to apply ExternalSecret: %s\n%w", string(output), err)
+	}
+
+	fmt.Printf("[SUCCESS] Applied ExternalSecret 'ghcr-auth' in 'flux-system' namespace.\n")
+	return nil
+}
+
 // CreateDockerHubExternalSecret generates and applies the ExternalSecret for Docker Hub.
 func CreateDockerHubExternalSecret() error {
 	fmt.Println("[INFO] Creating ExternalSecret for Docker Hub in 'flux-system' namespace...")