version: 1
kind: platform-infra-secret-plane
metadata:
  id: hwlab-secret-plane
  owner: HWLAB
  spec: pikasTech/HWLAB#2233
  relatedIssues:
    - 2233
    - 2234
defaults:
  targetId: JD01
targets:
  - id: D601
    route: D601:k3s
    namespace: platform-infra
    role: standby
    enabled: false
    createNamespace: true
  - id: D518
    route: D518:k3s
    namespace: platform-infra
    role: standby
    enabled: false
    createNamespace: true
  - id: JD01
    route: JD01:k3s
    namespace: platform-infra
    role: active
    enabled: true
    createNamespace: true
eso:
  enabled: true
  version: v2.7.0
  manifestUrl: https://github.com/external-secrets/external-secrets/releases/download/v2.7.0/external-secrets.yaml
  releaseName: external-secrets
  controllerDeploymentName: external-secrets
  webhookDeploymentName: external-secrets-webhook
  certControllerDeploymentName: external-secrets-cert-controller
  crds:
    - secretstores.external-secrets.io
    - externalsecrets.external-secrets.io
    - clustersecretstores.external-secrets.io
vault:
  mode: dev-kv-v2
  deploymentName: hwlab-secret-plane-vault
  serviceName: hwlab-secret-plane-vault
  tokenSecretName: hwlab-secret-plane-vault-token
  tokenSecretKey: token
  image:
    repository: hashicorp/vault
    tag: 1.20.3
    pullPolicy: IfNotPresent
  port: 8200
  bootstrap:
    tokenMode: generated-if-missing
    tokenLengthBytes: 32
syncProbe:
  secretStoreName: hwlab-secret-plane-vault
  clusterSecretStoreName: hwlab-secret-plane-vault-cluster
  externalSecretName: hwlab-secret-plane-poc
  targetSecretName: hwlab-secret-plane-poc-sync
  refreshInterval: 15s
  vaultMountPath: secret
  remotePath: hwlab-secret-plane/poc
  remoteProperty: password
  expectedFingerprint: sha256:dbc852e80ed37ccc9d8596eb47976839c9c77e4a5afda972ce62ad29db9132dd
  testValueSource:
    mode: repo-poc-static
    value: hwlab-secret-plane-poc-jd01
  consumer:
    deploymentName: hwlab-secret-plane-consumer
    envName: POC_PASSWORD
    image:
      repository: busybox
      tag: 1.36.1
      pullPolicy: IfNotPresent
validation:
  timeoutSeconds: 45
  pollSeconds: 3