---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: postgres-credentials
  namespace: artifactapi
spec:
  destination:
    create: true
    name: postgres-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/artifactapi/default/postgres-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: environment
  namespace: artifactapi
spec:
  destination:
    create: true
    name: environment
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/artifactapi/default/environment
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Authentik OIDC client for the artifactapi UI front door (client_id,
# client_secret, cookie_secret). Seeded out of band at
# kv/kubernetes/namespace/artifactapi/default/oauth-credentials; the default
# k8s auth role already grants the artifactapi/default ServiceAccount read on
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so no
# terraform-vault change is needed. Consumed by the oauth2 Deployment.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: artifactapi
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/artifactapi/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default