{{- if .Values.externalSecrets.enabled }}
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: {{ include "planpal.storeName" . }}
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  provider:
    aws:
      service: SecretsManager
      region: {{ .Values.externalSecrets.region }}
      # credentials come from the ESO controller's Pod Identity role; no keys here.
{{- range $target, $key := .Values.externalSecrets.secrets }}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ $target }}
  namespace: {{ include "planpal.namespace" $ }}
  annotations:
    argocd.argoproj.io/sync-wave: "0"
spec:
  refreshInterval: {{ $.Values.externalSecrets.refreshInterval }}
  secretStoreRef: { name: {{ include "planpal.storeName" $ }}, kind: ClusterSecretStore }
  target:
    name: {{ $target }}
    creationPolicy: Owner
  dataFrom:
    - extract: { key: {{ $key }} }
{{- end }}
{{- end }}