{{/*
Hetzner API token Secret consumed by hcloud-cloud-controller-manager.

Rendered into the chart's targetNamespace (`kube-system` by convention)
from a value sourced via Flux `valuesFrom` against the canonical
`flux-system/cloud-credentials` Secret (key `hcloud-token`). Mirrors the
pattern used by bp-cluster-autoscaler-hcloud + bp-hcloud-csi when wiring
the Hetzner API token from the single per-Sovereign Secret cloud-init
writes (ADR-0001 §11.3).

The upstream hcloud-cloud-controller-manager chart's deployment template
injects this Secret's `token` key as the `HCLOUD_TOKEN` env var via the
`env.HCLOUD_TOKEN.valueFrom.secretKeyRef.name=hcloud-token,key=token`
binding in this chart's values.yaml.

The Secret is only rendered when `hcloudCcm.hcloudToken` is non-empty —
Helm will skip this template during `helm template` on an empty string
so a per-Sovereign overlay that switches to ExternalSecret materialisation
(Phase 2+ target state) does not collide with this Secret.
*/}}
{{- if .Values.hcloudCcm.hcloudToken }}
---
apiVersion: v1
kind: Secret
metadata:
  name: hcloud-token
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-hcloud-ccm.labels" . | nindent 4 }}
type: Opaque
stringData:
  token: {{ .Values.hcloudCcm.hcloudToken | quote }}
  # NETWORK is read by hcloud-CCM from the same Secret as `network` —
  # only emitted when the operator passed a non-empty networkID via the
  # per-Sovereign overlay. When empty, the Pod skips Network-mode
  # reconciliation (no private-network routes).
  {{- if .Values.hcloudCcm.networkID }}
  network: {{ .Values.hcloudCcm.networkID | quote }}
  {{- end }}
{{- end }}
