# Vault — namespace only
# Helm release and GCP SA secret managed by Argo CD + ESO
# See: apps/vault.yaml, apps/vault-config.yaml, k8s/vault/
# Note: vault-gcp-sa.json must be stored in Vault at secret/vault-gcp-sa (sa_json field)
# before the ESO ExternalSecret can sync it.

resource "kubernetes_namespace" "vault" {
  metadata {
    name = "vault"
    labels = {
      managed-by = "terraform"
      tier       = "platform"
    }
  }
}