# Real PAT lives only in Vault (secrets/kong-v2/payments/dev/konnect-pat),
# never in git, never manually kubectl-applied. refreshInterval controls how
# often ESO re-checks Vault and re-syncs the K8s Secret if the value
# changed there — rotation becomes "update Vault", nothing to touch in the
# cluster.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: payments-dev-konnect-auth
  namespace: payments
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-kong-v2
  target:
    name: payments-dev-konnect-auth
    template:
      metadata:
        labels:
          konghq.com/credential: konnect
          konghq.com/secret: "true"
  data:
    - secretKey: token
      remoteRef:
        key: kong-v2/payments/dev/konnect-pat
        property: token