# Reads this deployment's secrets from Vault. Scope the AppRole's policy to the
# path this store reads and nothing more, so a workload here cannot reach
# another estate's secrets.
#
# The Vault side is created once, outside this repo:
#
#   vault policy write <policy> -  <<'HCL'
#   path "<mount>/data/<path>/*"     { capabilities = ["read"] }
#   path "<mount>/metadata/<path>/*" { capabilities = ["list", "read"] }
#   HCL
#   vault write auth/approle/role/<role> token_policies=<policy> \
#     token_ttl=1h token_max_ttl=4h
#   kubectl -n external-secrets create secret generic ${VAULT_APPROLE_SECRET} \
#     --from-literal=roleId=$(vault read -field=role_id auth/approle/role/<role>/role-id) \
#     --from-literal=secretId=$(vault write -f -field=secret_id auth/approle/role/<role>/secret-id)
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: ${VAULT_STORE_NAME}
spec:
  provider:
    vault:
      server: ${VAULT_SERVER}
      path: ${VAULT_MOUNT}
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: ${VAULT_APPROLE_SECRET}
            namespace: external-secrets
            key: roleId
          secretRef:
            name: ${VAULT_APPROLE_SECRET}
            namespace: external-secrets
            key: secretId