---
# Authentik OIDC client for the mediamark front door (client_id, client_secret,
# cookie_secret) at kv/kubernetes/namespace/mediamark/default/oauth-credentials.
# The default k8s role's templated policy already grants read on
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
# terraform-vault change is needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: mediamark
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/mediamark/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default