---
# ExternalSecret pulls credentials from 1Password Connect
# and creates a standard Kubernetes Secret that Glance reads
# as environment variables injected into the container.
#
# Prerequisites: ESO + 1Password Connect installed in fastpass
# 1Password vault item: "the-hub" with fields matching below
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: the-hub-secrets
  namespace: the-hub
  labels:
    app.kubernetes.io/name: the-hub
    app.kubernetes.io/part-of: mk-labs
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: onepassword-connect       # ClusterSecretStore name from your ESO bootstrap
    kind: ClusterSecretStore
  target:
    name: the-hub-secrets
    creationPolicy: Owner
  data:
    # Proxmox API token (read-only, created in Datacenter > API Tokens)
    - secretKey: PROXMOX_TOKEN
      remoteRef:
        key: the-hub
        property: proxmox_token

    # Proxmox Backup Server API token
    - secretKey: PBS_TOKEN
      remoteRef:
        key: the-hub
        property: pbs_token

    # Grafana service account token (read-only)
    - secretKey: GRAFANA_TOKEN
      remoteRef:
        key: the-hub
        property: grafana_token

    # Gitea personal access token (read-only)
    - secretKey: GITEA_TOKEN
      remoteRef:
        key: the-hub
        property: gitea_token