---
# ExternalSecret for Unpoller Unifi credentials
# Syncs credentials from Vault to Kubernetes Secret
#
# BOOTSTRAP SETUP:
# ================
# After first deployment, store your Unifi credentials in Vault:
#
#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
#     unifi-user="your-unifi-username" \
#     unifi-pass="your-unifi-password"
#
# Or use the API key approach (recommended):
#   kubectl exec -n vault vault-0 -- vault kv put secret/unpoller \
#     unifi-user="your-api-key" \
#     unifi-pass="your-api-key"
#
# The ExternalSecret will automatically sync these to a Kubernetes secret
# and Reloader will restart Unpoller when they change.
#
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: unpoller-secret
  namespace: unpoller
  annotations:
    meta.helm.sh/release-name: unpoller
    meta.helm.sh/release-namespace: unpoller
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-backend
  target:
    name: unpoller-secret
    creationPolicy: Owner
  data:
    - secretKey: unifi-user
      remoteRef:
        key: secret/unpoller
        property: unifi-user
    - secretKey: unifi-pass
      remoteRef:
        key: secret/unpoller
        property: unifi-pass