# Replaces the gitignored k8s/secret.yaml: the Grafana admin credentials and
# the service account token the MCP server authenticates with now come from
# Vault, so nothing sensitive has to exist on a laptop to deploy this stack.
#
# The target keeps the name every consumer already uses, so neither the Grafana
# Deployment nor mcp-grafana changes.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: observability-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-observability
  target:
    name: observability-secrets
    creationPolicy: Owner
  dataFrom:
    # Whole-secret pull rather than key-by-key: adding a key in Vault then
    # reaches the cluster without editing this file.
    - extract:
        key: observability/grafana