# Read-only access to the web-petting-db Secret in the psql namespace
# (see postgresql/databases/web-petting.yaml for the other half).
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: psql-credentials
spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: web-petting-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: web-petting-secrets
    template:
      data:
        WEB_PETTING_DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/web_petting"
  data:
    - secretKey: username
      remoteRef:
        key: web-petting-db
        property: username
    - secretKey: password
      remoteRef:
        key: web-petting-db
        property: password