---
# SecretStore for the CI namespace — uses GCP Secret Manager via Workload Identity.
# The gitea-runner-gke GCP SA has secretmanager.secretAccessor on gitea-runner-token
# (see servers/gcp/gitea-runner.tf).
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: gcp-secretmanager
  namespace: ci
spec:
  provider:
    gcpsm:
      projectID: neuron-785695
      auth:
        workloadIdentity:
          clusterLocation: us-central1
          clusterName: neuron-platform
          serviceAccountRef:
            name: gitea-runner
            namespace: ci
---
# Pull the Gitea runner registration token from Secret Manager into a k8s Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: gitea-runner-token
  namespace: ci
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: gcp-secretmanager
    kind: SecretStore
  target:
    name: gitea-runner-token
    creationPolicy: Owner
  data:
    - secretKey: GITEA_RUNNER_REGISTRATION_TOKEN
      remoteRef:
        key: gitea-runner-token