---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: default
  namespace: zitadel
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: zitadel
    serviceAccount: zitadel
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: zitadel-masterkey
  namespace: zitadel
spec:
  type: kv-v2
  mount: secret
  path: zitadel/master-key
  destination:
    name: zitadel-masterkey
    create: true
  refreshAfter: 1h
  vaultAuthRef: default
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: zitadel-db
  namespace: zitadel
spec:
  mount: database
  path: static-creds/zitadel
  allowStaticCreds: true
  refreshAfter: 5m
  destination:
    name: zitadel-db
    create: true
  rolloutRestartTargets:
    - kind: Deployment
      name: zitadel
  vaultAuthRef: default