# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
# can substitute it instead of carrying a hardcoded UUID.
#
# Why a second ExternalSecret rather than extra keys on the existing one:
# substituteFrom requires the Secret to sit in the same namespace as the Flux
# Kustomization, which is flux-system — a shared, broadly-readable namespace.
# The Konnect token must never go there. A Control Plane id is not a secret;
# it is visible in the Konnect UI URL.
#
# Terraform writes this path (see konnect-platform). Moving to a new Konnect
# org then needs no edit here at all.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: catalog-dev-control-plane
  namespace: flux-system
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-kong-v2
  target:
    name: catalog-dev-control-plane
  data:
    # Key names are the Flux substitution variables verbatim: substituteFrom
    # exposes each key as ${KEY}.
    - secretKey: CONTROL_PLANE_ID
      remoteRef:
        key: kong-v2/catalog/dev/control-plane
        property: CONTROL_PLANE_ID
    - secretKey: CONTROL_PLANE_NAME
      remoteRef:
        key: kong-v2/catalog/dev/control-plane
        property: CONTROL_PLANE_NAME