feat(zot): 接入 SeaweedFS 与 SPIRE 并统一 S3 凭据来源

platform/external-secrets/externalsecrets.yaml

@@ -101,6 +101,7 @@ spec:
 # The chart normally GENERATES seaweedfs-s3-secret from s3.credentials. We point
 # filer.s3.existingConfigSecret at this one instead, so the chart stops rendering
 # credentials from values entirely.
+# zot 的 AK/SK 只保存在 k8s/zot-s3；在此组装服务端配置，不在基础配置中维护副本。
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -114,6 +115,38 @@ spec:
   target:
     name: seaweedfs-s3-config
     creationPolicy: Owner
-  dataFrom:
-    - extract:
+    template:
+      engineVersion: v2
+      mergePolicy: Replace
+      data:
+        seaweedfs_s3_config: |-
+          {{- $config := mustFromJson .baseConfig -}}
+          {{- if not (kindIs "slice" $config.identities) -}}
+            {{- fail "base S3 configuration must contain an identities array" -}}
+          {{- end -}}
+          {{- if or (eq .zotAccessKey "") (eq .zotSecretKey "") -}}
+            {{- fail "zot S3 credentials must not be empty" -}}
+          {{- end -}}
+          {{- $identities := list -}}
+          {{- range $config.identities -}}
+            {{- if ne .name "zot" -}}
+              {{- $identities = append $identities . -}}
+            {{- end -}}
+          {{- end -}}
+          {{- $credential := dict "accessKey" .zotAccessKey "secretKey" .zotSecretKey -}}
+          {{- $zot := dict "name" "zot" "credentials" (list $credential) "actions" (list "Read:zot" "Write:zot" "List:zot" "Tagging:zot") -}}
+          {{- $_ := set $config "identities" (append $identities $zot) -}}
+          {{- mustToJson $config -}}
+  data:
+    - secretKey: baseConfig
+      remoteRef:
         key: k8s/seaweedfs-s3
+        property: seaweedfs_s3_config
+    - secretKey: zotAccessKey
+      remoteRef:
+        key: k8s/zot-s3
+        property: access_key
+    - secretKey: zotSecretKey
+      remoteRef:
+        key: k8s/zot-s3
+        property: secret_key