---
# SecretStore for GKE — uses GCP Secret Manager directly via Workload Identity.
# The DocuSeal GCP SA has secretmanager.secretAccessor on its own secrets
# (see servers/gcp/docuseal.tf).
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: gcp-secretmanager
  namespace: docuseal
spec:
  provider:
    gcpsm:
      projectID: neuron-785695
      # Workload Identity — ESO impersonates the docuseal-gke GCP SA to access
      # Secret Manager. No JSON key file required.
      auth:
        workloadIdentity:
          clusterLocation: us-central1
          clusterName: neuron-platform
          serviceAccountRef:
            name: docuseal
            namespace: docuseal
---
# Pull all DocuSeal secrets from GCP Secret Manager into a single k8s Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: docuseal-secrets
  namespace: docuseal
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: gcp-secretmanager
    kind: SecretStore
  target:
    name: docuseal-secrets
    creationPolicy: Owner
  data:
    - secretKey: secret_key_base
      remoteRef:
        key: docuseal-secret-key-base
    - secretKey: smtp_host
      remoteRef:
        key: docuseal-smtp-host
    - secretKey: smtp_port
      remoteRef:
        key: docuseal-smtp-port
    - secretKey: smtp_username
      remoteRef:
        key: docuseal-smtp-username
    - secretKey: smtp_password
      remoteRef:
        key: docuseal-smtp-password
    - secretKey: smtp_from
      remoteRef:
        key: docuseal-smtp-from