{{- /*
ExternalSecret — Phase 2+ target state for the PowerDNS API key.

In Phase 0 (bootstrap-kit install on a fresh Sovereign), the
`powerdns-api-credentials` Secret is rendered by bp-powerdns
(platform/powerdns/chart/templates/api-credentials-secret.yaml) from a
helm value. Once OpenBao is provisioned on the Sovereign and
external-secrets-operator is reconciling, the per-Sovereign overlay
flips externalDns.externalSecret.enabled = true and the API key flows
from OpenBao instead — same Secret name, same key, but the source of
truth becomes the Sovereign's vault.

DEFAULT FALSE — Phase 0 path leaves bp-powerdns as the sole writer of
the powerdns-api-credentials Secret. Enabling this template before
OpenBao is reconciling would create an ExternalSecret that the operator
can't fulfil and the cluster would never reach Ready.

Per docs/INVIOLABLE-PRINCIPLES.md #4 every knob (refreshInterval,
secretStoreRef, remoteRef path) is operator-tunable; the remoteRef.key
is overridden by the per-Sovereign Composition that creates this
HelmRelease at provision time.
*/}}
{{- /*
Capabilities gate: bp-external-secrets ships the
`external-secrets.io/v1beta1` CRD that backs ExternalSecret — it is NOT
in the bootstrap-kit. On a cold install of a fresh Sovereign before
external-secrets-operator is reconciling, the apiserver rejects
ExternalSecret with `no matches for kind ExternalSecret in version
external-secrets.io/v1beta1`. The Capabilities check skips this template
until the CRD is registered, at which point the gate is a no-op. This
is the architectural pattern from issue #190 — defense in depth alongside
the values-toggle (`externalDns.externalSecret.enabled`).
*/}}
{{- if and .Values.externalDns.externalSecret.enabled (.Capabilities.APIVersions.Has "external-secrets.io/v1beta1") }}
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: powerdns-api-credentials
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-external-dns.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ .Values.externalDns.externalSecret.refreshInterval | default "1h" | quote }}
  secretStoreRef:
    name: {{ .Values.externalDns.externalSecret.secretStoreRef.name | quote }}
    kind: {{ .Values.externalDns.externalSecret.secretStoreRef.kind | quote }}
  target:
    name: {{ .Values.externalDns.externalSecret.target.name | default "powerdns-api-credentials" | quote }}
    creationPolicy: Owner
  data:
    {{- range .Values.externalDns.externalSecret.data }}
    - secretKey: {{ .secretKey | quote }}
      remoteRef:
        key: {{ .remoteRef.key | quote }}
        property: {{ .remoteRef.property | quote }}
    {{- end }}
{{- end }}
