---
# sonarr API key. Seeded at kv/kubernetes/namespace/arrstack/default/sonarr
# (key: apitoken); the default k8s role's templated policy already grants read
# on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
# syncs it into the sonarr-apikey Secret that the apikey-init initContainer reads
# to enforce <ApiKey> in /config/config.xml (Vault is source of truth).
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: sonarr-apikey
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: sonarr-apikey
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/arrstack/default/sonarr
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default