---
# CNPG app-user credentials (keys: username, password). Consumed by the Cluster
# bootstrap (initdb.secret) AND by NetBox (externalDatabase.existingSecretName).
# One-time Vault seed — see the PR description.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: postgres-credentials
  namespace: netbox
spec:
  destination:
    create: true
    name: postgres-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/postgres-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Config secret. Keys:
#   secret_key         : Django SECRET_KEY (50+ random chars). One-time Vault seed.
#   api_token_peppers  : JSON object {"1": "<50+ char random>"} used to HMAC-hash
#                        v2 API tokens. One-time Vault seed — rotating a pepper
#                        invalidates existing v2 tokens, so set it once.
# VSO syncs every key at the path into the destination Secret, and the NetBox
# chart mounts both keys from it (existingSecret) — no explicit key mapping needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: netbox-secret-key
  namespace: netbox
spec:
  destination:
    create: true
    name: netbox-secret-key
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/netbox-secret-key
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Bootstrap superuser (keys: username, password, email, api_token). Applied by
# NetBox on first boot. One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: netbox-superuser
  namespace: netbox
spec:
  destination:
    create: true
    name: netbox-superuser
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/netbox-superuser
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Authentik OIDC client secret. Two keys at the same Vault path:
#   client_secret : raw secret, read by the terraform-authentik provider runner
#                   (policy already grants kv/.../namespace/+/default/oauth-credentials).
#   oidc.yaml     : a YAML fragment 'SOCIAL_AUTH_OIDC_SECRET: "<secret>"', mounted
#                   into NetBox via values.yaml extraConfig (the chart's config
#                   loader globs /run/config/extra/*/*.yaml).
# One-time Vault seed — see the PR description.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: netbox
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
