---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: mediamark
spec:
  allowedNamespaces:
    - mediamark
  kubernetes:
    audiences:
      - vault
    role: default
    serviceAccount: default
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: k8s/au/syd1
  vaultConnectionRef: vso-system/default
---
# Separate auth for the arrstack secrets engine: the `mediamark` k8s role is the
# only one whose policy grants arrstack/creds/mediamark.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: arrstack-creds
  namespace: mediamark
spec:
  allowedNamespaces:
    - mediamark
  kubernetes:
    audiences:
      - vault
    role: mediamark
    serviceAccount: default
    tokenExpirationSeconds: 600
  method: kubernetes
  mount: k8s/au/syd1
  vaultConnectionRef: vso-system/default