# Jenkins API credentials for toolshed's builder.
#
# builder holds these and nothing else — no Kubernetes access, no session
# signing key. It is the service that talks to an external system over HTTP
# with long-running operations, so it is also the one most likely to hang or
# crash; keeping its blast radius to "can drive Jenkins" is deliberate.
#
# Use a dedicated Jenkins user rather than the admin account, with an API
# token rather than a password. Jenkins issues tokens under
# <user> -> Configure -> API Token -> Add new Token, and shows the value
# exactly once.
#
# The user needs Job/Create as well as Job/Build and Job/Read: builder creates
# an app's job the first time it deploys, which is what guarantees the SCM
# polling trigger is present. Without that trigger a webhook can never find
# the job no matter how exactly the repository URL matches (claude.md issue
# #30) — creating jobs through the API is what stops that being something a
# person has to remember.
#
#   kubectl -n vault exec -i vault-0 -- sh -lc '
#     vault login <root-token> >/dev/null &&
#     vault kv put secret/toolshed/jenkins \
#       username=<jenkins user> \
#       token=<api token>'
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: toolshed-jenkins
  namespace: toolshed
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: toolshed-jenkins
    creationPolicy: Owner
  data:
    - secretKey: username
      remoteRef:
        key: toolshed/jenkins
        property: username
    - secretKey: token
      remoteRef:
        key: toolshed/jenkins
        property: token