# CCR-2026-0017 / CCR-2026-0018 (KEY-WP-0013-T02, RPF-WP-0035-T05).
# KeyCape-side delivery of the two approval-engine confidential client secrets.
# The Kubernetes Secret key stays client-secret to match the live
# KEYCAPE_RAPP_QONTO_CLIENT_SECRET secretKeyRef shape; the OpenBao field is
# CLIENT_SECRET because KV field names are uppercase by platform convention.
#
# Apply only after the stores sync and inside the agreed attended rollout window;
# the KeyCape image that reads both environment names rolls out after these sync.
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycape-secrets-engine-approval-client
  namespace: sso
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-keycape-secrets-engine-approval
  target:
    name: keycape-secrets-engine-approval-client
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: client-secret
      remoteRef:
        key: workloads/secrets-engine/approval-client
        property: CLIENT_SECRET
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycape-approval-engine-operator-client
  namespace: sso
spec:
  refreshInterval: 5m
  secretStoreRef:
    kind: ClusterSecretStore
    name: openbao-keycape-approval-engine-operator
  target:
    name: keycape-approval-engine-operator-client
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: client-secret
      remoteRef:
        key: workloads/approval-engine/operator-client
        property: CLIENT_SECRET