# Moved out of flux-system with the Kustomization that reads it. It only ever
# lived there because postBuild.substituteFrom resolves in the Kustomization's
# own namespace, and that Kustomization had to be in flux-system to reach
# dataplane-template-defaults. Both now sit in the domain namespace, so the
# control-plane id no longer transits a shared namespace at all.
# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
# can substitute it instead of carrying a hardcoded UUID.
#
# Why a second ExternalSecret rather than extra keys on the existing one:
# substituteFrom requires the Secret to sit in the same namespace as the Flux
# Kustomization, which is flux-system — a shared, broadly-readable namespace.
# The Konnect token must never go there. A Control Plane id is not a secret;
# it is visible in the Konnect UI URL.
#
# Terraform writes this path (see konnect-platform). Moving to a new Konnect
# org then needs no edit here at all.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: sales-dev-control-plane
  namespace: sales
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-kong-v2
  target:
    name: sales-dev-control-plane
  data:
    # Key names are the Flux substitution variables verbatim: substituteFrom
    # exposes each key as ${KEY}.
    - secretKey: CONTROL_PLANE_ID
      remoteRef:
        key: kong-v2/sales/dev/control-plane
        property: CONTROL_PLANE_ID
    - secretKey: CONTROL_PLANE_NAME
      remoteRef:
        key: kong-v2/sales/dev/control-plane
        property: CONTROL_PLANE_NAME