# ------------------------------------------------------------------------------
# ExternalSecret — Cloudflare API Token
# Pulled from 1Password, materialized in the external-dns-cloudflare namespace.
#
# PREREQUISITE: Ryan must create the following 1Password item before ArgoCD
# can sync this secret successfully:
#   - Item name:  cloudflare-external-dns
#   - Field name: api-token
#   - Value:      A Cloudflare API token scoped to DNS Edit on mk-labs.cloud
#
# Until that item exists, the ExternalSecret will report SecretSyncedError —
# this is expected and acceptable. The ExternalDNS pod will fail to start
# until the secret is available.
# ------------------------------------------------------------------------------
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: cloudflare-api-token
  namespace: external-dns-cloudflare
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: cloudflare-api-token
    creationPolicy: Owner
  data:
    - secretKey: cloudflare_api_token
      remoteRef:
        key: cloudflare-external-dns   # 1Password item name
        property: api-token            # 1Password field name