# Runtime secrets for Trust Service + Control Plane (WP-0011).
#
# OpenBao path (platform KV v2): workloads/target-revenue/runtime-secrets
# Fields:
#   TRF_SIGNING_KEY_HEX          — 64 hex chars Ed25519 seed (32 bytes)
#   TRF_CONTROL_PLANE_SECRET_KEY — session cookie signing secret
#   TRF_DATABASE_URL             — psycopg DSN for trf_app role
#   TRF_MIGRATE_DATABASE_URL     — DSN for trf_owner (migrate/bootstrap Jobs)
#
# Pre-reqs: ESO + ClusterSecretStore openbao (railiance-platform);
# OpenBao policy granting read of the path above.
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: target-revenue-runtime
  namespace: target-revenue
  labels:
    app.kubernetes.io/name: target-revenue
    app.kubernetes.io/part-of: target-revenue
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: openbao
    kind: ClusterSecretStore
  target:
    name: target-revenue-runtime
    creationPolicy: Owner
  data:
    - secretKey: TRF_SIGNING_KEY_HEX
      remoteRef:
        key: workloads/target-revenue/runtime-secrets
        property: TRF_SIGNING_KEY_HEX
    - secretKey: TRF_CONTROL_PLANE_SECRET_KEY
      remoteRef:
        key: workloads/target-revenue/runtime-secrets
        property: TRF_CONTROL_PLANE_SECRET_KEY
    - secretKey: TRF_DATABASE_URL
      remoteRef:
        key: workloads/target-revenue/runtime-secrets
        property: TRF_DATABASE_URL
    - secretKey: TRF_MIGRATE_DATABASE_URL
      remoteRef:
        key: workloads/target-revenue/runtime-secrets
        property: TRF_MIGRATE_DATABASE_URL