# ------------------------------------------------------------------------------
# ClusterSecretStore — 1Password Connect
#
# This is the bridge between ESO and 1Password Connect. Once this exists,
# any ExternalSecret in any namespace can reference:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: onepassword-connect
#
# The connect-token secret must exist in the onepassword-connect namespace.
# Generate a token in 1Password: Developer Tools > Connect Servers > <your server>
# Then apply once:
#   kubectl create secret generic connect-token \
#     --from-literal=token=<your-token> \
#     -n onepassword-connect
# ------------------------------------------------------------------------------
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: onepassword-connect
spec:
  provider:
    onepassword:
      connectHost: http://onepassword-connect.onepassword-connect.svc.cluster.local:8080
      vaults:
        mk-labs: 1          # vault name in 1Password : priority
      auth:
        secretRef:
          connectTokenSecretRef:
            name: connect-token
            key: token
            namespace: onepassword-connect