apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao
  annotations:
    # Give ESO + OpenBao time to become healthy before ArgoCD tries to sync this.
    argocd.argoproj.io/sync-wave: "1"
spec:
  provider:
    vault:
      server: "http://{{ .Release.Name }}-openbao.{{ .Release.Namespace }}.svc:8200"
      path: {{ .Values.eso.kvMountPath }}
      version: v2
      auth:
        kubernetes:
          mountPath: kubernetes
          role: {{ .Values.eso.roleName }}
          serviceAccountRef:
            name: {{ .Values.eso.serviceAccountName }}
            namespace: {{ .Values.eso.namespace }}