oci_registry_auth_secret: >-
  {{ lookup(
    "cache",
    "kubernetes.core.k8s",
    kind="Secret",
    namespace="default",
    resource_name="imagepull-gitea"
  ) }}

oci_registry_auth: >-
  {{ (oci_registry_auth_secret
       .data[".dockerconfigjson"]
       | b64decode
       | from_json
     ).auths["git.pyrocufflink.net"]
  }}