---
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: teslamate-cnpg-secret
  namespace: teslamate
spec:
  length: 42
  digits: 5
  symbols: 5
  symbolCharacters: "-_$@"
  noUpper: false
  allowRepeat: true
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: teslamate-cnpg-secret
  namespace: teslamate
spec:
  # how often to rotate the DB password
  refreshInterval: "24h"
  target:
    # This will merge the generated password into the existing pg-teslamate-app secret
    name: pg-teslamate-app
    creationPolicy: Merge
    template:
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        # Override the password field with our ESO-generated password
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: teslamate-cnpg-secret