apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-user-engine-runtime
  labels:
    app.kubernetes.io/part-of: net-kingdom-sso-mfa
    net-kingdom/component: secret-delivery
spec:
  conditions:
    - namespaces: [user-engine]
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: openbao-user-engine-runtime-approle
            namespace: external-secrets
            key: role-id
          secretRef:
            name: openbao-user-engine-runtime-approle
            namespace: external-secrets
            key: secret-id
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-sso-user-engine-runtime
  labels:
    app.kubernetes.io/part-of: net-kingdom-sso-mfa
    net-kingdom/component: secret-delivery
spec:
  conditions:
    - namespaces: [sso]
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: openbao-sso-user-engine-runtime-approle
            namespace: external-secrets
            key: role-id
          secretRef:
            name: openbao-sso-user-engine-runtime-approle
            namespace: external-secrets
            key: secret-id
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: user-engine-runtime
  namespace: user-engine
  labels:
    app.kubernetes.io/name: user-engine
    app.kubernetes.io/part-of: user-engine
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-user-engine-runtime
  target:
    name: user-engine-runtime
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: proxy-secret
      remoteRef:
        key: workloads/user-engine/runtime
        property: PROXY_SECRET
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: identity-provisioner-client
  namespace: user-engine
  labels:
    app.kubernetes.io/name: user-engine
    app.kubernetes.io/part-of: user-engine
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-user-engine-runtime
  target:
    name: identity-provisioner-client
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: token
      remoteRef:
        key: workloads/user-engine/runtime
        property: PROVISIONER_TOKEN
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: identity-provisioner-token
  namespace: sso
  labels:
    app.kubernetes.io/name: identity-provisioner
    app.kubernetes.io/part-of: net-kingdom-sso-mfa
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-sso-user-engine-runtime
  target:
    name: identity-provisioner-token
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: token
      remoteRef:
        key: workloads/user-engine/runtime
        property: PROVISIONER_TOKEN