# Shared by every kong-v2 domain — one Vault connection, not duplicated per
# domain. Auth is AppRole (not Kubernetes auth): Vault at vault.sttlab.eu
# can't reach back into this cluster's API server to validate SA tokens
# (local cluster's API is https://127.0.0.1:26443, not internet-reachable) —
# Kubernetes auth was the first choice but isn't viable here.
#
# Both roleId and secretId come from vault-approle-kong-v2 (ns
# external-secrets) — created directly via `vault write` + `kubectl create
# secret`, never written to a file. Scoped read-only to secrets/kong-v2/*
# via Vault policy kong-v2-readonly (see Vault directly for policy/role
# definitions — not tracked in this repo, no Terraform-for-Vault yet).
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-kong-v2
spec:
  provider:
    vault:
      server: https://vault.sttlab.eu
      path: secrets
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: vault-approle-kong-v2
            namespace: external-secrets
            key: roleId
          secretRef:
            name: vault-approle-kong-v2
            namespace: external-secrets
            key: secretId