---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: argocd-oidc
  namespace: argocd
spec:
  vaultAuthRef: default
  mount: kv
  type: kv-v2
  # Seeded out of band; same secret is read by terraform-authentik to configure
  # the provider's client_secret. Key: client_secret.
  path: kubernetes/namespace/argocd/default/oauth-credentials
  refreshAfter: 5m
  hmacSecretData: true
  destination:
    name: argocd-oidc
    create: true
    overwrite: true
    # ArgoCD only resolves `$secret:key` references against Secrets carrying
    # this label.
    labels:
      app.kubernetes.io/part-of: argocd