# External Secrets Operator Example
# Generate External Secrets Operator manifests for GitOps workflows

version: '1.0'

variables:
  namespace: default
  aws_region: us-west-2
  secret_store_name: aws-secretsmanager

providers:
  # Kubernetes provider for validation (optional)
  kubernetes:
    kind: kubernetes
    auth:
      kind: ambient
      config:
        context: production-cluster

secrets:
  # Database password synced from AWS Secrets Manager
  - name: database_password
    kind: random_password
    config:
      length: 32
      special: true
    targets:
      # Generate ExternalSecret manifest
      - provider: kubernetes
        kind: external_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: postgres-credentials
          external_secret_name: postgres-password-sync
          secret_store_ref: "{{ var.secret_store_name }}"
          backend_type: aws
          backend_key: prod/db/postgres/password
          refresh_interval: 1h
          output_path: ./manifests/external-secret-postgres.yaml
          labels:
            app: postgres
            managed-by: secretzero
          annotations:
            description: PostgreSQL password from AWS Secrets Manager

  # API keys from AWS Secrets Manager
  - name: stripe_api_key
    kind: static
    config:
      # This would be stored in AWS Secrets Manager
      default: sk_live_example_key
    targets:
      - provider: kubernetes
        kind: external_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: stripe-credentials
          external_secret_name: stripe-api-key-sync
          secret_store_ref: "{{ var.secret_store_name }}"
          backend_type: aws
          backend_key: prod/stripe/api-key
          refresh_interval: 24h
          output_path: ./manifests/external-secret-stripe.yaml
          labels:
            app: payment-service

  # Multiple secrets from different backends
  - name: azure_keyvault_secret
    kind: static
    config:
      default: placeholder
    targets:
      - provider: kubernetes
        kind: external_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: azure-secret
          external_secret_name: azure-secret-sync
          secret_store_ref: azure-keyvault
          backend_type: azure
          backend_key: my-secret
          refresh_interval: 30m
          output_path: ./manifests/external-secret-azure.yaml
          labels:
            cloud-provider: azure

  # HashiCorp Vault secret
  - name: vault_secret
    kind: static
    config:
      default: placeholder
    targets:
      - provider: kubernetes
        kind: external_secret
        config:
          namespace: "{{ var.namespace }}"
          secret_name: vault-secret
          external_secret_name: vault-secret-sync
          secret_store_ref: vault-backend
          backend_type: vault
          backend_key: secret/data/myapp/config
          refresh_interval: 15m
          output_path: ./manifests/external-secret-vault.yaml
          labels:
            backend: vault

metadata:
  project: external-secrets-operator
  owner: platform-team
  description: |
    External Secrets Operator integration for GitOps workflows.
    
    This example generates ExternalSecret manifests that can be:
    1. Committed to a Git repository
    2. Deployed via GitOps tools (ArgoCD, Flux)
    3. Automatically synced by External Secrets Operator
    
    Prerequisites:
    - External Secrets Operator installed in cluster
    - SecretStore/ClusterSecretStore configured
    - Backend systems (AWS, Azure, Vault) configured
    
    Usage:
    1. Run: secretzero sync -f examples/kubernetes-external-secrets.yml
    2. Review generated manifests in ./manifests/
    3. Commit manifests to Git repository
    4. Deploy via GitOps tool
