Initial argo deployment

cluster/platform/onepassword-connect/cluster-secret-store.yaml

@@ -0,0 +1,32 @@
+# ------------------------------------------------------------------------------
+# ClusterSecretStore — 1Password Connect
+#
+# This is the bridge between ESO and 1Password Connect. Once this exists,
+# any ExternalSecret in any namespace can reference:
+#   secretStoreRef:
+#     kind: ClusterSecretStore
+#     name: onepassword-connect
+#
+# The connect-token secret must exist in the onepassword-connect namespace.
+# Generate a token in 1Password: Developer Tools > Connect Servers > <your server>
+# Then apply once:
+#   kubectl create secret generic connect-token \
+#     --from-literal=token=<your-token> \
+#     -n onepassword-connect
+# ------------------------------------------------------------------------------
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: onepassword-connect
+spec:
+  provider:
+    onepassword:
+      connectHost: http://onepassword-connect.onepassword-connect.svc.cluster.local:8080
+      vaults:
+        mk-labs: 1          # vault name in 1Password : priority
+      auth:
+        secretRef:
+          connectTokenSecretRef:
+            name: connect-token
+            key: token
+            namespace: onepassword-connect