apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: shadowsocks-config
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vaultwarden-fields
    kind: ClusterSecretStore
  target:
    name: shadowsocks-config
    creationPolicy: Owner
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        config.json: |
          {
            "server": "0.0.0.0",
            "server_port": 8388,
            "method": "chacha20-ietf-poly1305",
            "password": {{ .password | toJson }},
            "mode": "tcp_and_udp"
          }
  data:
    - secretKey: password
      remoteRef:
        key: k8s/shadowsocks/secrets
        property: Password