{{- /*
ESO → K8s Secret that holds the Root CA (cert + key).
Lives in the cert-manager namespace so the private key stays off app
namespaces; cert-manager reads it when the ClusterIssuer signs leaf certs.
*/}}
{{- if .Values.externalSecret.enabled }}
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: {{ .Values.rootCASecretName }}
  namespace: {{ .Values.namespace }}
  annotations:
    argocd.argoproj.io/sync-wave: "-5"
    {{- with .Values.commonAnnotations }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
  {{- with .Values.commonLabels }}
  labels:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
  dataFrom:
    - extract:
        conversionStrategy: Default
        key: {{ .Values.externalSecret.vaultPath }}
        {{- if .Values.externalSecret.vaultVersion }}
        version: {{ .Values.externalSecret.vaultVersion | quote }}
        {{- end }}
  refreshInterval: {{ .Values.externalSecret.refreshInterval | quote }}
  secretStoreRef:
    kind: ClusterSecretStore
    name: {{ .Values.externalSecret.secretStoreRef.name }}
  target:
    name: {{ .Values.rootCASecretName }}
    creationPolicy: Owner
    deletionPolicy: Retain
{{- end }}