apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: openbao
  annotations:
    # Give ESO + OpenBao time to become healthy before ArgoCD tries to sync this.
    argocd.argoproj.io/sync-wave: "1"
spec:
  provider:
    vault:
      server: "{{ if .Values.tls.enabled }}https{{ else }}http{{ end }}://{{ include "openbao-gitops.openbaoFullname" . }}.{{ .Release.Namespace }}.svc:8200"
      path: {{ .Values.eso.kvMountPath }}
      version: v2
      {{- if .Values.tls.enabled }}
      caProvider:
        type: Secret
        name: {{ .Values.tls.secretName }}
        namespace: {{ .Release.Namespace }}
        key: tls.crt
      {{- end }}
      auth:
        kubernetes:
          mountPath: kubernetes
          role: {{ .Values.eso.roleName }}
          serviceAccountRef:
            name: {{ .Values.eso.serviceAccountName }}
            namespace: {{ .Values.eso.namespace }}