apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: dmz-infisical
  namespace: hf-n8n
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  provider:
    infisical:
      hostAPI: http://infisical-infisical-standalone-infisical.platform-infisical.svc.cluster.local:8080
      auth:
        universalAuthCredentials:
          clientId:
            name: infisical-universal-auth
            key: clientId
          clientSecret:
            name: infisical-universal-auth
            key: clientSecret
      secretsScope:
        projectSlug: platform-kubernetes-pqmd
        environmentSlug: prod
        secretsPath: /tenants/pidoka/n8n
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: n8n-secret
  namespace: hf-n8n
  annotations:
    argocd.argoproj.io/sync-wave: "2"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: dmz-infisical
    kind: SecretStore
  target:
    name: n8n-secret
    creationPolicy: Merge
    deletionPolicy: Retain
  data:
    - secretKey: BASIC_AUTH_USER
      remoteRef:
        key: BASIC_AUTH_USER
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: BASIC_AUTH_PASSWORD
      remoteRef:
        key: BASIC_AUTH_PASSWORD
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
    - secretKey: ENCRYPTION_KEY
      remoteRef:
        key: ENCRYPTION_KEY
        conversionStrategy: Default
        decodingStrategy: None
        metadataPolicy: None
