# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005).
#
# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets
# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
#
# Prereqs on railiance01:
#   - External Secrets Operator (make eso-deploy)
#   - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore)
#   - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token
#     (make reuse-openbao-eso-token-apply)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: reuse-surface-runtime
  namespace: reuse
  labels:
    app.kubernetes.io/name: reuse-surface
    app.kubernetes.io/part-of: railiance-apps
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-reuse
  target:
    name: reuse-surface-env
    creationPolicy: Owner
  data:
    - secretKey: REUSE_SURFACE_TOKEN
      remoteRef:
        key: workloads/reuse/reuse-surface/runtime-secrets
        property: REUSE_SURFACE_TOKEN
    - secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET
      remoteRef:
        key: workloads/reuse/reuse-surface/runtime-secrets
        property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET