apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: oci-l4-relay-wan-controller
  namespace: kube-system
spec:
  method: kubernetes
  mount: kubernetes
  kubernetes:
    role: oci-l4-relay-wan-controller
    serviceAccount: oci-l4-relay-wan-controller
  vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: opnsense-interface-watcher
  namespace: kube-system
spec:
  type: kv-v2
  mount: secret
  path: opnsense/interface-watcher
  destination:
    name: opnsense-interface-watcher
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        key:
          text: '{{ get .Secrets "key" }}'
        secret:
          text: '{{ get .Secrets "secret" }}'
  rolloutRestartTargets:
    - kind: Deployment
      name: oci-l4-relay-wan-controller
  vaultAuthRef: oci-l4-relay-wan-controller
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: opnsense-root-ca
  namespace: kube-system
spec:
  type: kv-v2
  mount: secret
  path: ca/opnsense
  hmacSecretData: true
  refreshAfter: 1h
  destination:
    name: ca-opnsense
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        ca.crt:
          text: >-
            {{- $ca := get .Secrets "certificate" -}}
            {{- if not (hasPrefix "-----BEGIN CERTIFICATE-----" $ca) -}}
            {{- fail "CA publication is pending" -}}
            {{- end -}}
            {{- $ca -}}
  rolloutRestartTargets:
    - kind: Deployment
      name: oci-l4-relay-wan-controller
  vaultAuthRef: oci-l4-relay-wan-controller
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: oci-l4-relay-wan-controller-api
  namespace: kube-system
spec:
  type: kv-v2
  mount: secret
  path: oci/relay/wan-controller-api
  destination:
    name: oci-l4-relay-wan-controller-api
    create: true
    overwrite: true
    transformation:
      excludeRaw: true
      excludes:
        - .*
      templates:
        tenancy_ocid:
          text: '{{ get .Secrets "tenancy_ocid" }}'
        user_ocid:
          text: '{{ get .Secrets "user_ocid" }}'
        fingerprint:
          text: '{{ get .Secrets "fingerprint" }}'
        private_key:
          text: |
            {{ get .Secrets "private_key" }}
        region:
          text: '{{ get .Secrets "region" }}'
        network_security_group_id:
          text: '{{ get .Secrets "network_security_group_id" }}'
        security_rule_id:
          text: '{{ get .Secrets "security_rule_id" }}'
  rolloutRestartTargets:
    - kind: Deployment
      name: oci-l4-relay-wan-controller
  vaultAuthRef: oci-l4-relay-wan-controller