---
# ExternalSecret — pulls RCON password from 1Password Connect
# Prereq: create a "minecraft" item in the mk-labs 1Password vault
#   with a field named "rcon_password" set to a strong random password.
#   Generate one: openssl rand -base64 24
#
# ClusterSecretStore: onepassword-connect (platform/onepassword-connect/)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: papermc-rcon
  namespace: minecraft
  labels:
    app.kubernetes.io/name: minecraft
    app.kubernetes.io/component: papermc
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: onepassword-connect
    kind: ClusterSecretStore
  target:
    name: papermc-rcon
    creationPolicy: Owner
  data:
    - secretKey: rcon-password
      remoteRef:
        key: minecraft
        property: rcon_password