# Credential delivery for the transactional receiver (EMAIL-WP-0004-T03).
#
# PREREQUISITES (railiance-platform, not this repo):
#   - ClusterSecretStore openbao-email-connect limited to this namespace
#   - OpenBao policy external-secrets-email-connect + role external-secrets-email-connect
#   - Operator-provisioned KV at platform/workloads/email-connect/transactional
#     (fields listed below; no secret values in Git)
# Apply order: ClusterSecretStore → this ExternalSecret → Deployment.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: email-connect-runtime
  namespace: email-connect
  labels:
    app.kubernetes.io/name: email-connect
    app.kubernetes.io/part-of: email-connect
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-email-connect
  target:
    name: email-connect-runtime
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    # Shared bearer for user-engine → email-connect. user-engine holds the same
    # value as EMAIL_CONNECT_INGEST_TOKEN under its own custody path; this
    # service never receives SMTP material from the caller.
    - secretKey: EMAIL_CONNECT_INGEST_TOKEN
      remoteRef:
        key: platform/workloads/email-connect/transactional
        property: EMAIL_CONNECT_INGEST_TOKEN
    - secretKey: EMAIL_CONNECT_SMTP_USERNAME
      remoteRef:
        key: platform/workloads/email-connect/transactional
        property: EMAIL_CONNECT_SMTP_USERNAME
    - secretKey: EMAIL_CONNECT_SMTP_PASSWORD
      remoteRef:
        key: platform/workloads/email-connect/transactional
        property: EMAIL_CONNECT_SMTP_PASSWORD