---
# Per-deployment token-hash pepper. Seeded (openssl rand) at
# kv/kubernetes/namespace/arrstack/default/arrproxy-pepper (key: pepper); the
# default k8s role's templated policy already grants read on
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
# syncs it into the arrproxy-pepper Secret consumed by arrproxy-api as
# ARRPROXY_PEPPER.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: arrproxy-pepper
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: arrproxy-pepper
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/arrstack/default/arrproxy-pepper
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Authentik OIDC client for the arrstack front door (client_id, client_secret,
# cookie_secret), created by terraform-authentik at
# kv/kubernetes/namespace/arrstack/default/oauth-credentials. VSO syncs it into
# the oauth-credentials Secret consumed by the oauth2-proxy Deployment.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: arrstack
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/arrstack/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default