first commit

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,27 @@
+# Real PAT lives only in Vault (secrets/kong-v2/customers/dev/konnect-pat),
+# never in git, never manually kubectl-applied. refreshInterval controls how
+# often ESO re-checks Vault and re-syncs the K8s Secret if the value
+# changed there — rotation becomes "update Vault", nothing to touch in the
+# cluster.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: customers-dev-konnect-auth
+  namespace: customers
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: customers-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/customers/dev/konnect-pat
+        property: token