# clustersecretstore-vault-region1.yaml — Catalyst-curated default
# ClusterSecretStore for ESO, wired to the in-cluster bp-openbao service.
#
# Why a Catalyst-shipped ClusterSecretStore (not user-authored):
#   Every Catalyst Sovereign has the SAME default secret-store wiring —
#   ESO ↔ bp-openbao. Shipping the ClusterSecretStore inside this chart
#   means a fresh Sovereign reaches "ESO can read from OpenBao" the moment
#   bp-external-secrets reconciles, with no follow-up CR-application step.
#
# Why a Helm post-install hook:
#   ClusterSecretStore is an external-secrets.io/v1beta1 CRD that ESO
#   itself installs. Without the hook, Helm renders both the upstream ESO
#   chart (which installs the CRD) AND this template in the same install
#   pass, and the apiserver applies them in alphabetical / dependency-
#   resolution order. If the CRD is registered AFTER this template's
#   admission attempt, the apply fails with `no matches for kind
#   "ClusterSecretStore" in version "external-secrets.io/v1beta1"`. The
#   post-install hook defers application until after the upstream chart's
#   CRDs + controllers are running.
#
# Why ALSO post-upgrade:
#   On Helm upgrade Helm replays every template; without post-upgrade the
#   ClusterSecretStore would be deleted+recreated at every upgrade only
#   when CRDs are reapplied. Including post-upgrade keeps the hook in
#   sync without stranding.
#
# Operator overrides:
#   - clusterSecretStore.enabled: false  → disable the default and author
#     ClusterSecretStore CRs out-of-band (e.g. multi-region with explicit
#     primary/replica).
#   - clusterSecretStore.server         → point at an external OpenBao FQDN
#     when ESO is reading from a different region's primary.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #4 ("never hardcode") all knobs are
# runtime-configurable; cluster overlays in clusters/<sovereign>/ may set
# `clusterSecretStore.*` without rebuilding the Blueprint OCI artifact.

{{- $css := .Values.clusterSecretStore | default dict }}
{{- if $css.enabled }}
{{- $name := $css.name | default "vault-region1" }}
{{- $server := $css.server | default "http://openbao.openbao.svc.cluster.local:8200" }}
{{- $path := $css.path | default "secret" }}
{{- $version := $css.version | default "v2" }}
{{- $kAuth := $css.kubernetesAuth | default dict }}
{{- $mountPath := $kAuth.mountPath | default "kubernetes" }}
{{- $role := $kAuth.role | default "external-secrets" }}
{{- $saName := $kAuth.serviceAccountName | default "external-secrets" }}
{{- $saNs := $kAuth.serviceAccountNamespace | default "external-secrets-system" }}
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: {{ $name | quote }}
  labels:
    catalyst.openova.io/component: external-secrets
    catalyst.openova.io/secret-backend: openbao
spec:
  provider:
    # ESO provider type stays `vault` because OpenBao is wire-compatible
    # with HashiCorp Vault (per platform/openbao/README.md). The same
    # provider config drives both backends.
    vault:
      server: {{ $server | quote }}
      path: {{ $path | quote }}
      version: {{ $version | quote }}
      auth:
        kubernetes:
          mountPath: {{ $mountPath | quote }}
          role: {{ $role | quote }}
          serviceAccountRef:
            name: {{ $saName | quote }}
            namespace: {{ $saNs | quote }}
{{- end }}
