external-secrets:
  # Same as the homelab's, which carries nothing cluster-specific: the
  # controller is configured entirely by the ClusterSecretStore and
  # ExternalSecret objects in devops-infra-argo-config-gcp, not by values.
  #
  # This is the piece every credential in the cluster hangs off — Harbor,
  # Jenkins, Grafana and the pipeline all read their secrets from Vault
  # through it, so it comes up before any of them.
  #
  # Two things must exist in Vault before the first ExternalSecret can sync,
  # and neither is declarative: the KV v2 engine at secret/, and the
  # Kubernetes auth method with a role bound to this controller's service
  # account. Until then ExternalSecrets stay in a retry loop rather than
  # failing outright.
  #
  # installCRDs defaults to true — kept, as on a fresh cluster there are no
  # existing SecretStore/ExternalSecret CRs whose schema it could clobber.
  #
  # All three components default to unbounded resources; trimmed here for
  # the same reason as everything else in this repo.
  resources:
    requests:
      cpu: 25m
      memory: 32Mi
    limits:
      memory: 128Mi

  webhook:
    resources:
      requests:
        cpu: 25m
        memory: 32Mi
      limits:
        memory: 64Mi

  certController:
    resources:
      requests:
        cpu: 25m
        memory: 32Mi
      limits:
        memory: 64Mi