# Reads secrets/observability/* from Vault. Deliberately not reusing the
# vault-kong-v2 store: its AppRole carries the kong-v2-readonly policy, scoped
# to secrets/data/kong-v2/*, so it simply cannot see this path — verified, a
# probe ExternalSecret against it failed with "could not get secret data from
# provider". Widening that policy would have given the Kong reader access to
# observability's secrets for no reason.
#
# The AppRole credentials are NOT in git. Created once against Vault:
#   vault policy write observability-readonly  (read on secrets/{data,metadata}/observability/*)
#   vault write auth/approle/role/observability-eso token_policies=observability-readonly
#   vault read  auth/approle/role/observability-eso/role-id
#   vault write -f auth/approle/role/observability-eso/secret-id
#   kubectl -n external-secrets create secret generic vault-approle-observability \
#     --from-literal=roleId=<...> --from-literal=secretId=<...>
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-observability
spec:
  provider:
    vault:
      server: https://vault.sttlab.eu
      path: secrets
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: vault-approle-observability
            namespace: external-secrets
            key: roleId
          secretRef:
            name: vault-approle-observability
            namespace: external-secrets
            key: secretId