apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: body-wars-credentials
  namespace: open-webui
  annotations:
    # Sync priority: ExternalSecret fetches from 1Password before other resources deploy
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: onepassword-connect
  target:
    name: body-wars-secret
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        vllm-api-key: "{{ .vllm_api_key }}"
  data:
    # vLLM API key from 1Password (mk-labs vault, vllm item, api-key field)
    - secretKey: vllm_api_key
      remoteRef:
        key: vllm
        property: api-key