---
# ClusterSecretStore — connects ESO to Vault using the root token Secret.
# The vault-token Secret (name: vault-token, key: token) must be created
# via kubectl as a one-time bootstrap step before this store can sync:
#
#   kubectl create secret generic vault-token \
#     --namespace external-secrets \
#     --from-literal=token=$(cat ~/Secrets/tokens/vault-root-token)
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: vault
spec:
  provider:
    vault:
      server: "https://vault.neuralplatform.ai"
      path: "secret"
      version: "v2"
      auth:
        tokenSecretRef:
          name: vault-token
          namespace: external-secrets
          key: token