{{/*
Hetzner API token Secret consumed by the hcloud-csi controller.

Rendered into the chart's targetNamespace (`hcloud-csi` by convention)
from a value sourced via Flux `valuesFrom` against the canonical
`flux-system/cloud-credentials` Secret (key `hcloud-token`). Mirrors the
pattern used by bp-hcloud-ccm and bp-cluster-autoscaler-hcloud — see
platform/hcloud-ccm/chart/templates/hcloud-token-secret.yaml for the
matching shape and ADR-0001 §11.3 for the cloud-init seam.

The bp-hcloud-csi subchart's controller looks up the Secret by name
(default `hcloud-csi-token`, key `token`) — see
.Values.hetznerTokenSecretRef + the upstream
hcloud-csi.controller.hcloudToken.existingSecret binding in values.yaml.

The Secret is only rendered when:
  - .Values.enabled is true (master gate; the rest of the chart's
    rendering is gated on the same value)
  - .Values.hetznerToken is non-empty (Flux `valuesFrom` populates
    this from cloud-credentials at HelmRelease apply time)

When .Values.hetznerToken is empty Helm skips this template entirely so
a per-Sovereign overlay that switches to an externally-managed
ExternalSecret (Phase 2+) can take over without collision.

2026-05-17 t143 (C9-006): created so the bootstrap-kit slot
17a-bp-hcloud-csi.yaml wires the token in the same shape as
55-bp-hcloud-ccm.yaml does — without this Secret the hcloud-csi
controller cannot authenticate to the Hetzner API, the StorageClass
exists but every PVC fails to provision with a 401 from the CSI driver.
*/}}
{{- if and .Values.enabled .Values.hetznerToken }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Values.hetznerTokenSecretRef.name | default "hcloud-csi-token" | quote }}
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bp-hcloud-csi
    app.kubernetes.io/component: hcloud-token
    catalyst.openova.io/blueprint: bp-hcloud-csi
    catalyst.openova.io/blueprint-version: {{ .Chart.Version | quote }}
type: Opaque
stringData:
  {{ .Values.hetznerTokenSecretRef.key | default "token" }}: {{ .Values.hetznerToken | quote }}
{{- end }}
