apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: body-wars-credentials
  namespace: body-wars
  annotations:
    # Sync priority: ExternalSecret fetches from 1Password before other resources deploy
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: onepassword-connect
    kind: ClusterSecretStore
  target:
    name: body-wars-secret
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        vllm-api-key: "{{ .vllm_api_key }}"
        openwebui-admin-password: "{{ .openwebui_admin }}"
  data:
    - secretKey: vllm_api_key
      remoteRef:
        path: mk-labs/vllm/api-key
    - secretKey: openwebui_admin
      remoteRef:
        path: mk-labs/openwebui/admin-password