---
# Authentik OIDC client for watchstate (client_id, client_secret, cookie_secret)
# seeded at kv/kubernetes/namespace/watchstate/default/oauth-credentials; the
# watchstate/default templated policy grants read, so no terraform-vault change
# is needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: watchstate-oauth-credentials
  namespace: watchstate
spec:
  destination:
    create: true
    name: watchstate-oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/watchstate/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default