---
# CNPG app-user credentials (keys: username, password). Consumed by the Cluster
# bootstrap (initdb.secret) AND by NetBox (externalDatabase.existingSecretName).
# One-time Vault seed — see the PR description.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: postgres-credentials
  namespace: netbox
spec:
  destination:
    create: true
    name: postgres-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/postgres-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Django SECRET_KEY (key: secret_key). One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: netbox-secret-key
  namespace: netbox
spec:
  destination:
    create: true
    name: netbox-secret-key
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/netbox-secret-key
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Bootstrap superuser (keys: username, password, email, api_token). Applied by
# NetBox on first boot. One-time Vault seed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: netbox-superuser
  namespace: netbox
spec:
  destination:
    create: true
    name: netbox-superuser
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/netbox-superuser
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Authentik OIDC client secret. Two keys at the same Vault path:
#   client_secret : raw secret, read by the terraform-authentik provider runner
#                   (policy already grants kv/.../namespace/+/default/oauth-credentials).
#   oidc.yaml     : a YAML fragment 'SOCIAL_AUTH_OIDC_SECRET: "<secret>"', mounted
#                   into NetBox via values.yaml extraConfig (the chart's config
#                   loader globs /run/config/extra/*/*.yaml).
# One-time Vault seed — see the PR description.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: netbox
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/netbox/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default