# GitLab cross-site replication (see
# /home/scooby/.claude/plans/jiggly-snacking-iverson.md) - same pattern
# and same reasoning as
# infrastructure/authentik/manifests/ha-postgres-app-pushsecret.yaml:
# pg-gitlab-app/pg-praefect-app are CNPG-generated, not Vault-native -
# each cluster independently generated its own random `app` role
# password at bootstrap time. Streaming replication keeps the two
# clusters' actual live passwords in sync (WAL includes role/password
# changes), but the two clusters' K8s Secret OBJECTS never resync on
# their own - this closes that gap, self-healing on refreshInterval
# instead of a one-time fix that goes stale on the next rotation.
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: pg-gitlab-app-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: pg-gitlab-app
  data:
    - match:
        secretKey: password
        remoteRef:
          remoteKey: vps/pg-gitlab-app
          property: password
---
apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: pg-praefect-app-to-vps
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRefs:
    - name: vault-backend
      kind: ClusterSecretStore
  selector:
    secret:
      name: pg-praefect-app
  data:
    - match:
        secretKey: password
        remoteRef:
          remoteKey: vps/pg-praefect-app
          property: password