# Replaces the manually-applied secret.yaml — the real PAT now lives only
# in Vault (secrets/kong-v2/catalog/dev/konnect-pat), never in git, never
# manually kubectl-applied again. refreshInterval controls how often ESO
# re-checks Vault and re-syncs the K8s Secret if the value changed there —
# rotation becomes "update Vault", nothing to touch in the cluster.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: catalog-dev-konnect-auth
  namespace: catalog
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-kong-v2
  target:
    name: catalog-dev-konnect-auth
    template:
      metadata:
        labels:
          konghq.com/credential: konnect
          konghq.com/secret: "true"
  data:
    - secretKey: token
      remoteRef:
        key: kong-v2/catalog/dev/konnect-pat
        property: token