# CCR-2026-0026 (INFD-WP-0002, RPF-WP-0042). Source only. Do not apply from this
# file. KeyCape env KEYCAPE_INFORMED_DECISION_SITTING_REQUESTER_CLIENT_SECRET
# uses Kubernetes Secret key client-secret; OpenBao field is CLIENT_SECRET.
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao-keycape-informed-decision-sitting-requester
  labels:
    app.kubernetes.io/part-of: railiance-gitops
    railiance-platform/component: external-secrets
    app.kubernetes.io/name: keycape
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: external-secrets-keycape-informed-decision-sitting-requester
          serviceAccountRef:
            name: external-secrets
            namespace: external-secrets
  conditions:
  - namespaces:
    - sso
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycape-informed-decision-sitting-requester-client
  namespace: sso
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-keycape-informed-decision-sitting-requester
  target:
    name: keycape-informed-decision-sitting-requester-client
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
  - secretKey: client-secret
    remoteRef:
      key: workloads/informed-decision/sitting-requester
      property: CLIENT_SECRET