---
# ExternalSecret for Gitea credentials
# Syncs secrets from GCP Secret Manager (backstage-secrets JSON) to Kubernetes
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: gitea-credentials
  namespace: argo-workflows
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: gcpsm-secret-store
  target:
    name: gitea-credentials
    creationPolicy: Owner
  data:
    - secretKey: url
      remoteRef:
        key: backstage-secrets
        property: GITEA_URL
    - secretKey: username
      remoteRef:
        key: backstage-secrets
        property: GITEA_USERNAME
    - secretKey: password
      remoteRef:
        key: backstage-secrets
        property: GITEA_PASSWORD
---
# ExternalSecret for ArgoCD credentials
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: argocd-credentials
  namespace: argo-workflows
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: gcpsm-secret-store
  target:
    name: argocd-credentials
    creationPolicy: Owner
  data:
    - secretKey: server
      remoteRef:
        key: backstage-secrets
        property: ARGOCD_SERVER
    - secretKey: username
      remoteRef:
        key: backstage-secrets
        property: ARGOCD_USERNAME
    - secretKey: password
      remoteRef:
        key: backstage-secrets
        property: ARGOCD_AUTH_TOKEN
---
# ExternalSecret for Argo Workflows token (for Backstage)
# This secret is created in the backstage namespace
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: argo-workflows-token
  namespace: backstage
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: gcpsm-secret-store
  target:
    name: argo-workflows-token
    creationPolicy: Owner
  data:
    - secretKey: token
      remoteRef:
        key: backstage-secrets
        property: ARGO_WORKFLOWS_TOKEN