# ExternalSecret - maelstrom-ui scoped API key
# Per inbox/ryan/2026-08-14-maelstrom-key-approval.md: Ryan approved pre-seeding
# via ExternalSecret (option b) since Ryan is the sole user of the pilot.
# Scoped key (resources/search/tasks read-only, no bot/admin) minted by Nick Fury,
# see system/inbox/agents/nick-fury/2026-08-14-maelstrom-ui-key-mint-complete.md
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: maelstrom-ui-credentials
  namespace: openviking
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
    description: "Scoped read-only API key for maelstrom (Web Studio UI)"
spec:
  refreshInterval: "1h"
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: maelstrom-ui-credentials
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        maelstrom_ui_key: "{{ .MAELSTROM_UI_KEY }}"
  data:
    - secretKey: MAELSTROM_UI_KEY
      remoteRef:
        key: openviking
        property: maelstrom-ui-key