# services/cassandra/secretproviderclass.yaml
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: cassandra-vault
  namespace: cassandra
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: "cassandra"
    objects: |
      - objectName: "harbor-pull__dockerconfigjson"
        secretPath: "kv/data/atlas/shared/harbor-pull"
        secretKey: "dockerconfigjson"
      - objectName: "cassandra-db__database-url"
        secretPath: "kv/data/atlas/cassandra/cassandra-db"
        secretKey: "DATABASE_URL"
      - objectName: "cassandra-db__user"
        secretPath: "kv/data/atlas/cassandra/cassandra-db"
        secretKey: "POSTGRES_USER"
      - objectName: "cassandra-db__password"
        secretPath: "kv/data/atlas/cassandra/cassandra-db"
        secretKey: "POSTGRES_PASSWORD"
      - objectName: "cassandra-oidc__client-secret"
        secretPath: "kv/data/atlas/cassandra/cassandra-oidc"
        secretKey: "client_secret"
      - objectName: "cassandra-app__session-secret"
        secretPath: "kv/data/atlas/cassandra/app-secrets"
        secretKey: "CASSANDRA_SESSION_SECRET"
      - objectName: "cassandra-app__byok-encryption-key"
        secretPath: "kv/data/atlas/cassandra/app-secrets"
        secretKey: "CASSANDRA_BYOK_ENCRYPTION_KEY"
  secretObjects:
    - secretName: harbor-regcred
      type: kubernetes.io/dockerconfigjson
      data:
        - objectName: harbor-pull__dockerconfigjson
          key: .dockerconfigjson
    - secretName: cassandra-runtime-secrets
      type: Opaque
      data:
        - objectName: cassandra-db__database-url
          key: DATABASE_URL
        - objectName: cassandra-db__user
          key: CASSANDRA_DATABASE_USER
        - objectName: cassandra-db__password
          key: CASSANDRA_DATABASE_PASSWORD
        - objectName: cassandra-oidc__client-secret
          key: CASSANDRA_OIDC_CLIENT_SECRET
        - objectName: cassandra-app__session-secret
          key: CASSANDRA_SESSION_SECRET
        - objectName: cassandra-app__byok-encryption-key
          key: CASSANDRA_BYOK_ENCRYPTION_KEY
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: cassandra-codex-cli
  namespace: cassandra
spec:
  provider: vault
  parameters:
    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
    roleName: "cassandra-sim"
    objects: |
      - objectName: "auth.json"
        secretPath: "kv/data/atlas/cassandra/codex-cli"
        secretKey: "auth.json"
        filePermission: 292