# RPF-WP-0021: three disjoint materialized Secrets for the Core Hub package.
# Apply only after the static CCR is approved/seeded and the database roles
# plus exact-scope renewable ESO token exist.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: core-hub-api-token
  namespace: core-hub
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-core-hub-runtime
  target:
    name: core-hub-api-token
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: CORE_HUB_API_TOKEN
      remoteRef:
        key: workloads/core-hub/runtime
        property: CORE_HUB_API_TOKEN
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: core-hub-runtime-database
  namespace: core-hub
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-core-hub-database
  target:
    name: core-hub-runtime-database
    creationPolicy: Owner
    deletionPolicy: Retain
  # A single extract mints one lease and keeps its username/password paired.
  dataFrom:
    - extract:
        key: creds/core-hub-runtime
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: core-hub-migration-database
  namespace: core-hub
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-core-hub-database
  target:
    name: core-hub-migration-database
    creationPolicy: Owner
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: creds/core-hub-migration
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: hub-core-runtime-database
  namespace: core-hub
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-core-hub-database
  target:
    name: hub-core-runtime-database
    creationPolicy: Owner
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: creds/hub-core-runtime
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: hub-core-migration-database
  namespace: core-hub
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-core-hub-database
  target:
    name: hub-core-migration-database
    creationPolicy: Owner
    deletionPolicy: Retain
  dataFrom:
    - extract:
        key: creds/hub-core-migration
