# External Secrets Operator configuration for Nessus PostgreSQL password rotation
# This auto-generates and rotates the database password in Vault
---
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: nessus-db-password
  namespace: nessus
spec:
  length: 32
  digits: 10
  symbols: 0  # No special chars to avoid escaping issues
  symbolCharacters: ""
  noUpper: false
  allowRepeat: true

---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: nessus-cnpg-secret
  namespace: nessus
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: nessus-db-secret
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        password: "{{ .password }}"
        username: "nessus"
        host: "pg-nessus-rw"
        port: "5432"
        database: "nessus"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: nessus-db-password