# Zerodha Kite Connect credentials for quant-agent.
#
# Entirely optional. With no apiKey present the agent uses its built-in
# simulated NSE feed, which is what lets the whole system run with no
# broker account.
#
# The access token is the awkward one: Kite tokens are single-session
# and expire every trading day around 06:00 IST, and minting a new one
# requires an interactive browser redirect that cannot be automated from
# inside a pod. Two options, neither automatic:
#   - re-run the vault kv put below each morning, or
#   - paste the fresh token into the agent's UI, which applies it live
#     without a restart (POST /api/kite-token).
#
# One-time setup:
#   kubectl -n vault exec -i vault-0 -- \
#     vault kv put secret/quant-agent/kite apiKey="..." accessToken="..."
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: quant-agent-kite
  namespace: quant-agent
spec:
  # Shorter than the usual 1h so a token refreshed in Vault mid-morning
  # reaches the pod reasonably quickly.
  refreshInterval: 15m
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: quant-agent-kite
    creationPolicy: Owner
  data:
    - secretKey: apiKey
      remoteRef:
        key: quant-agent/kite
        property: apiKey
    - secretKey: accessToken
      remoteRef:
        key: quant-agent/kite
        property: accessToken