{{- /*
PowerDNS REST API + webserver credentials.

Per docs/INVIOLABLE-PRINCIPLES.md #4 (never hardcode) the values flow from
helm install --set-string powerdns.apiKey=<random>,powerdns.webserverPassword=<random>
or, in the production deployment, from an ExternalSecret rendered by the
private-repo cluster manifest at clusters/contabo-mkt/apps/powerdns/.
This template ships a Secret that the upstream chart's deployment.yaml
reads via secretRef indirection (powerdns.api.key.secretRef and
powerdns.webserver.password.secretRef in values.yaml).

Bootstrap rendering: the chart REQUIRES values .Values.powerdns.apiKey
and .Values.powerdns.webserverPassword OR an existing
`powerdns-api-credentials` Secret in-cluster (the private-repo
ExternalSecret produces the latter at deploy time). When neither is set,
helm install errors with a useful message via `required`.
*/}}
{{- if and (not .Values.powerdns.apiKey) (not .Values.powerdns.useExistingApiSecret) }}
{{- /* Operator must provide the secret out-of-band. Skip Secret creation —
       the deployment will fail to start until the named Secret exists,
       which is the explicit signal we want. */ -}}
{{- else if .Values.powerdns.apiKey }}
apiVersion: v1
kind: Secret
metadata:
  name: powerdns-api-credentials
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-powerdns.labels" . | nindent 4 }}
type: Opaque
stringData:
  api-key: {{ required "powerdns.apiKey is required (random 32+ chars). See INVIOLABLE-PRINCIPLES #10." .Values.powerdns.apiKey | quote }}
  webserver-password: {{ required "powerdns.webserverPassword is required." .Values.powerdns.webserverPassword | quote }}
{{- end }}
