# ------------------------------------------------------------------------------
# ExternalSecret for Pure Storage FlashArray Credentials
# Syncs from 1Password to create px-pure-secret
#
# This secret contains pure.json with FlashArray configuration:
#   - Management endpoint
#   - API token
#   - NFS endpoint (if using file services)
#
# Expected 1Password structure:
#   Vault: homelab
#   Item: pure-flasharray-fastpass
#   Field: pure.json (contains the full JSON configuration)
#
# The pure.json format:
#   {
#     "FlashArrays": [
#       {
#         "MgmtEndPoint": "flasharray.mk-labs.cloud",
#         "APIToken": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
#         "NFSEndPoint": "flasharray-nfs.mk-labs.cloud"
#       }
#     ]
#   }
# ------------------------------------------------------------------------------
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: px-pure-secret
  namespace: portworx
  annotations:
    argocd.argoproj.io/sync-wave: "1"
spec:
  # Refresh interval
  refreshInterval: 1h

  # Reference to SecretStore (assumes ClusterSecretStore named "onepassword" exists)
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword

  # Target secret specification
  target:
    name: px-pure-secret
    creationPolicy: Owner
    template:
      type: Opaque
      metadata:
        labels:
          app.kubernetes.io/name: portworx-csi
          app.kubernetes.io/component: storage
      data:
        # The key must be "pure.json" - this is required by PX-CSI
        pure.json: "{{ .pure_config | toString }}"

  # Data to fetch from 1Password
  data:
    - secretKey: pure_config
      remoteRef:
        key: pure-flasharray-fastpass
        property: pure.json