From 0894e51ad57c727cddbfe6a321af15c863f09782 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Fri, 6 Mar 2026 18:33:21 +1100
Subject: [PATCH] feat: manage woodpecker-agent-secret in vault (#17)

- https://git.unkin.net/unkin/terraform-vault/pulls/60

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/17
---
 apps/base/woodpecker/vaultstaticsecret.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/apps/base/woodpecker/vaultstaticsecret.yaml b/apps/base/woodpecker/vaultstaticsecret.yaml
index 763dd74..80f49bc 100644
--- a/apps/base/woodpecker/vaultstaticsecret.yaml
+++ b/apps/base/woodpecker/vaultstaticsecret.yaml
@@ -15,3 +15,20 @@ spec:
   refreshAfter: 5m
   type: kv-v2
   vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: woodpecker-agent-secret
+  namespace: woodpecker
+spec:
+  destination:
+    create: true
+    name: woodpecker-agent-secret
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: service/woodpecker/woodpecker-agent-secret
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default