# GitLab cross-site replication Phase 1b - VPS's half of the Vault
# pipeline (apps/gitlab/manifests/ha-gitlab-secrets-pushsecret.yaml has
# home's half, which pushes the authoritative values into Vault at
# secret/vps/gitlab-{rails,gitlab-shell,gitaly,praefect}-secret). Pulls
# them back down here, BEFORE Phase 1c's Postgres replication goes live.
#
# creationPolicy: Owner (not Merge) - each of these secrets has exactly
# one key with nothing else to preserve, unlike pg-authentik-app which
# has CNPG-local host/dbname/username fields alongside the shared
# password. The chart's shared-secrets job skips creating a key that
# already exists, so having ESO own these outright is sufficient to stop
# the VPS from ever generating its own divergent values.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitlab-rails-secret
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: gitlab-rails-secret
    creationPolicy: Owner
  data:
    - secretKey: secrets.yml
      remoteRef:
        key: vps/gitlab-rails-secret
        property: secrets.yml
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitlab-gitlab-shell-secret
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: gitlab-gitlab-shell-secret
    creationPolicy: Owner
  data:
    - secretKey: secret
      remoteRef:
        key: vps/gitlab-gitlab-shell-secret
        property: secret
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitlab-gitaly-secret
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: gitlab-gitaly-secret
    creationPolicy: Owner
  data:
    - secretKey: token
      remoteRef:
        key: vps/gitlab-gitaly-secret
        property: token
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitlab-praefect-secret
  namespace: gitlab
spec:
  refreshInterval: 5m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: gitlab-praefect-secret
    creationPolicy: Owner
  data:
    - secretKey: token
      remoteRef:
        key: vps/gitlab-praefect-secret
        property: token