---
# Was a plain Secret with a live UniFi API key committed in plaintext -
# found and fixed 2026-08-20 (same class of issue as the Cloudflare token
# in infrastructure/cert-manager/manifests/secret-cf-token.yaml, which was
# already rotated to this pattern - this one was missed at the time).
# Moved to Vault+ExternalSecret, matching that precedent.
#
# The value in Vault right now (secret/unifi-api-key) is still the
# ORIGINAL key that was exposed in git history - rotating it (Settings ->
# Admins -> API Keys on the UniFi controller at https://172.28.110.1, no
# self-service API for this) is a separate, still-pending step. Once
# rotated:
#   vault kv put secret/unifi-api-key api-key=<new key>
# ESO picks it up automatically (refreshInterval below), no restart
# needed on external-dns's side.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: external-dns-unifi-secret
  namespace: external-dns
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-backend
  target:
    name: external-dns-unifi-secret
    creationPolicy: Owner
  data:
    - secretKey: api-key
      remoteRef:
        key: unifi-api-key
        property: api-key