---
# Authentik OIDC client for the repospawner front door (client_id,
# client_secret, cookie_secret). The default k8s role's templated policy already
# grants read on kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/*, so
# no terraform-vault change is needed.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oauth-credentials
  namespace: repospawner
spec:
  destination:
    create: true
    name: oauth-credentials
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/repospawner/default/oauth-credentials
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default
---
# Woodpecker API token (key `token`). Optional by design: without it the server
# still starts and refuses `woodpecker: true` requests with 503. The server
# mounts it to answer /api/capabilities; the enablement Job mounts the same
# secret by name via REPOSPAWNER_WOODPECKER_SECRET.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: repospawner-woodpecker
  namespace: repospawner
spec:
  destination:
    create: true
    name: repospawner-woodpecker
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/repospawner/default/woodpecker
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default