---
# GitHub App credentials (app_id, client_id, client_secret, private_key). Ben
# populates kv/kubernetes/namespace/ghp/default/github-app via the runbook; the
# default k8s role's templated policy already grants read here, so no
# terraform-vault change is needed. VSO syncs it into the ghp-github-app Secret.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: ghp-github-app
  namespace: ghp
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: ghp-github-app
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/ghp/default/github-app
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Application encryption key (encryption_key) from
# kv/kubernetes/namespace/ghp/default/app.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: ghp-app
  namespace: ghp
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: ghp-app
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/ghp/default/app
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default