# services/veles/secretproviderclass.yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: veles-vault
  namespace: veles
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: "veles"
    objects: |
      - objectName: "harbor-pull__dockerconfigjson"
        secretPath: "kv/data/atlas/shared/harbor-pull"
        secretKey: "dockerconfigjson"
      - objectName: "veles-db__database-url"
        secretPath: "kv/data/atlas/veles/veles-db"
        secretKey: "DATABASE_URL"
      - objectName: "veles-db__user"
        secretPath: "kv/data/atlas/veles/veles-db"
        secretKey: "POSTGRES_USER"
      - objectName: "veles-db__password"
        secretPath: "kv/data/atlas/veles/veles-db"
        secretKey: "POSTGRES_PASSWORD"
      - objectName: "veles-oidc__client-secret"
        secretPath: "kv/data/atlas/veles/veles-oidc"
        secretKey: "client_secret"
      - objectName: "veles-app__session-secret"
        secretPath: "kv/data/atlas/veles/app-secrets"
        secretKey: "VELES_SESSION_SECRET"
      - objectName: "veles-app__byok-encryption-key"
        secretPath: "kv/data/atlas/veles/app-secrets"
        secretKey: "VELES_BYOK_ENCRYPTION_KEY"
  secretObjects:
    - secretName: harbor-regcred
      type: kubernetes.io/dockerconfigjson
      data:
        - objectName: harbor-pull__dockerconfigjson
          key: .dockerconfigjson
    - secretName: veles-runtime-secrets
      type: Opaque
      data:
        - objectName: veles-db__database-url
          key: DATABASE_URL
        - objectName: veles-db__user
          key: VELES_DATABASE_USER
        - objectName: veles-db__password
          key: VELES_DATABASE_PASSWORD
        - objectName: veles-oidc__client-secret
          key: VELES_OIDC_CLIENT_SECRET
        - objectName: veles-app__session-secret
          key: VELES_SESSION_SECRET
        - objectName: veles-app__byok-encryption-key
          key: VELES_BYOK_ENCRYPTION_KEY
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: veles-codex-cli
  namespace: veles
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: "veles-sim"
    objects: |
      - objectName: "auth.json"
        secretPath: "kv/data/atlas/veles/codex-cli"
        secretKey: "auth.json"
        filePermission: 292