# Redis admin password, backing toolshed's managed cache add-on.
#
# Only one consumer, unlike the Postgres credential next door: the Redis
# server itself needs it to seed its ACL file on first boot. toolshed's api
# reads it from the *connection* an operator configures in the dashboard
# (encrypted in toolshed's own database via the secretbox keyring), not from
# a Kubernetes Secret — so there is deliberately no second ExternalSecret
# into the toolshed namespace here.
#
# Put the credential in Vault BEFORE syncing this. External Secrets cannot
# create a Secret for a path that does not exist, and the Redis pod's init
# container will sit in CreateContainerConfigError until it can:
#
#   kubectl -n vault exec -i vault-0 -- sh -lc '
#     vault login <root-token> >/dev/null &&
#     vault kv put secret/toolshed/redis \
#       password=<a long alphanumeric password>'
#
# Use an alphanumeric password. It is written into the ACL file as
# `user default on ><password> ...` by the init container, where a space or
# a quote would split the directive and produce a server that either fails
# to start or, worse, starts with different rules than intended.
#
# Remember that `kubectl exec` into Vault is unauthenticated by default —
# without the `vault login` the commands fail with a "preflight capability
# check" error that reads like a permissions bug rather than a missing
# login.
#
# Rotating this password later does NOT propagate to a running server: the
# init container only ever writes the ACL file when it is absent, precisely
# so it cannot delete the per-app users toolshed has provisioned into it.
# To rotate, update Vault and then, against the running server:
#
#   ACL SETUSER default >newpassword
#   ACL SAVE
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: redis-credentials
  namespace: redis
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    name: redis-credentials
    creationPolicy: Owner
  data:
    - secretKey: password
      remoteRef:
        key: toolshed/redis
        property: password