{{/*
Hetzner API token Secret consumed by cluster-autoscaler.

Rendered into the chart's targetNamespace from a value sourced via Flux
`valuesFrom` against the canonical `flux-system/cloud-credentials` Secret
(key `hcloud-token`). Mirrors the pattern used by bp-velero +
bp-cnpg-objectstorage when wiring object-storage credentials from the
single per-Sovereign Secret cloud-init writes (ADR-0001 §11.3).

The upstream cluster-autoscaler chart's deployment template injects
this Secret's `token` key as the `HCLOUD_TOKEN` env var via the
`extraEnvSecrets.HCLOUD_TOKEN` value in this chart's values.yaml.

The Secret is only rendered when `clusterAutoscalerHcloud.hcloudToken`
is non-empty — Helm will skip this template during `helm template` on
an empty string so a per-Sovereign overlay that switches to ExternalSecret
materialisation (Phase 2+ target state) does not collide with this Secret.
*/}}
{{- if .Values.clusterAutoscalerHcloud.hcloudToken }}
---
apiVersion: v1
kind: Secret
metadata:
  name: hcloud-token
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-cluster-autoscaler-hcloud.labels" . | nindent 4 }}
type: Opaque
stringData:
  token: {{ .Values.clusterAutoscalerHcloud.hcloudToken | quote }}
{{- end }}
