# Sync Option A offsite backup credentials into actcore-runtime-secret.
#
# Prereqs on railiance01:
#   - ClusterSecretStore openbao-activity-core
#   - ESO token includes policy workload-kv-read-railiance-backup-offsite-lane
#     (scripts/openbao-eso-token-apply.sh defaults updated in RAILIANCE-WP-0016)
#
# OpenBao path: platform/workloads/railiance/backup/offsite-lane
# Fields synced (never AGE_PRIVATE_KEY):
#   NC_WEBDAV_TOKEN, NC_WEBDAV_URL
# AGE_PUBLIC_KEY is not secret material; injected via ConfigMap/env default in CLI.
#
# Catalog: warden route show railiance-backup-offsite-lane
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: actcore-backup-offsite
  namespace: activity-core
  labels:
    app.kubernetes.io/name: activity-core
    app.kubernetes.io/part-of: activity-core
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-activity-core
  target:
    name: actcore-runtime-secret
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: NC_WEBDAV_TOKEN
      remoteRef:
        key: platform/workloads/railiance/backup/offsite-lane
        property: NC_WEBDAV_TOKEN
    - secretKey: NC_WEBDAV_URL
      remoteRef:
        key: platform/workloads/railiance/backup/offsite-lane
        property: NC_WEBDAV_URL