---
# vault-backup-credentials — R2 keys + restic password + Vault snapshot token
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: vault-backup-credentials
  namespace: vault
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault
    kind: ClusterSecretStore
  target:
    name: vault-backup-credentials
    creationPolicy: Owner
    template:
      data:
        VAULT_SNAPSHOT_TOKEN: "{{ .snapshot_token }}"
        RESTIC_PASSWORD: "vault-restic-2026"
        AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
        AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
        RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-vault-backup"
  data:
    - secretKey: snapshot_token
      remoteRef:
        key: secret/data/vault/snapshot-token
        property: token
    - secretKey: r2_access_key_id
      remoteRef:
        key: secret/data/r2
        property: access_key_id
    - secretKey: r2_secret_access_key
      remoteRef:
        key: secret/data/r2
        property: secret_access_key