---
# Authentik OIDC client for logviewer (client_id, client_secret, cookie_secret)
# seeded at kv/kubernetes/namespace/logging/default/oauth-credentials; the
# logging/default templated policy already grants read, so no terraform-vault
# change is needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: logviewer-oauth-credentials
  namespace: logging
spec:
  destination:
    create: true
    name: logviewer-oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/logging/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default