# Both Secrets are created by External Secrets Operator from OpenBao (KV v2).
# If a referenced key is missing in OpenBao the ExternalSecret reports an error and the
# Secret is not created - so pods wait in CreateContainerConfigError until it exists.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: expense-tracker-db
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.externalSecret.refreshInterval }}
  secretStoreRef:
    kind: {{ .Values.externalSecret.storeKind }}
    name: {{ .Values.externalSecret.storeName }}
  target:
    name: expense-tracker-db
    creationPolicy: Owner
  data:
    - secretKey: POSTGRES_PASSWORD
      remoteRef:
        key: {{ .Values.externalSecret.db.remoteKey }}
        property: {{ .Values.externalSecret.db.properties.password }}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: expense-tracker-app
  namespace: {{ .Values.namespace.name }}
  labels:
    app.kubernetes.io/name: expense-tracker
    {{- include "expense-tracker.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.externalSecret.refreshInterval }}
  secretStoreRef:
    kind: {{ .Values.externalSecret.storeKind }}
    name: {{ .Values.externalSecret.storeName }}
  target:
    name: expense-tracker-app
    creationPolicy: Owner
  data:
    - secretKey: SESSION_SECRET
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.sessionSecret }}
    - secretKey: ALLOWED_EMAILS
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.allowedEmails }}
    {{- if .Values.auth.google.enabled }}
    - secretKey: GOOGLE_CLIENT_ID
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.googleClientId }}
    - secretKey: GOOGLE_CLIENT_SECRET
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.googleClientSecret }}
    {{- end }}
    {{- if .Values.auth.openbao.enabled }}
    - secretKey: OPENBAO_CLIENT_ID
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.openbaoClientId }}
    - secretKey: OPENBAO_CLIENT_SECRET
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.openbaoClientSecret }}
    - secretKey: openbao-ca.crt
      remoteRef:
        key: {{ .Values.externalSecret.app.remoteKey }}
        property: {{ .Values.externalSecret.app.properties.openbaoCaCert }}
    {{- end }}