apiVersion: v1
kind: ServiceAccount
metadata:
  name: state-hub-preflight-eso
  namespace: state-hub
automountServiceAccountToken: false
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: openbao-state-hub-rename-preflight
  namespace: state-hub
spec:
  provider:
    vault:
      server: http://openbao.openbao.svc:8200
      path: platform
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: state-hub-rename-preflight-eso
          serviceAccountRef:
            name: state-hub-preflight-eso
            audiences: [openbao]
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: state-hub-rename-preflight
  namespace: state-hub
spec:
  refreshInterval: 1m
  secretStoreRef:
    name: openbao-state-hub-rename-preflight
    kind: SecretStore
  target:
    name: state-hub-rename-preflight
    creationPolicy: Owner
    deletionPolicy: Retain
  data:
    - secretKey: REPOSITORY_RENAME_PREFLIGHT_SECRET
      remoteRef:
        key: workloads/state-hub/repository-rename-preflight
        property: REPOSITORY_RENAME_PREFLIGHT_SECRET