---
# sonarr-kids API key. Seeded out-of-band at
# kv/kubernetes/namespace/arrstack/default/sonarr-kids (key: apitoken); the
# default k8s role's templated policy already grants read on
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
# syncs it into the sonarr-kids-apikey Secret consumed by the Deployment.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: sonarr-kids-apikey
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: sonarr-kids-apikey
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/arrstack/default/sonarr-kids
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default