---
# restic repository password for the k8up fafflix-config backups. Seeded at
# kv/kubernetes/namespace/fafflix/default/k8up-restic (key: password); the
# default k8s role's templated policy already grants read here, so no
# terraform-vault change is needed. VSO syncs it into the fafflix-k8up-restic
# Secret that the Schedule references via backend.repoPasswordSecretRef.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: fafflix-k8up-restic
  namespace: fafflix
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  destination:
    create: true
    name: fafflix-k8up-restic
    overwrite: true
  hmacSecretData: true
  mount: kv
  path: kubernetes/namespace/fafflix/default/k8up-restic
  refreshAfter: 5m
  type: kv-v2
  vaultAuthRef: default