apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  labels:
    app: investibook
    app.kubernetes.io/instance: investibook
  name: investibook-config-secret
spec:
  data:
    # Lark / Feishu bot credentials
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: LARK_APP_ID
      secretKey: LARK_APP_ID
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: LARK_APP_SECRET
      secretKey: LARK_APP_SECRET
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: LARK_VERIFICATION_TOKEN
      secretKey: LARK_VERIFICATION_TOKEN
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: LARK_ENCRYPT_KEY
      secretKey: LARK_ENCRYPT_KEY
    # Jira credentials
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: JIRA_USERNAME
      secretKey: JIRA_USERNAME
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: JIRA_API_TOKEN
      secretKey: JIRA_API_TOKEN
    # Clinic credentials
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: CLINIC_API_KEY
      secretKey: CLINIC_API_KEY
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: SKILL_CLINIC_API_KEY
      secretKey: SKILL_CLINIC_API_KEY
    # DevOps MCP credentials
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: DEVOPS_API_KEY
      secretKey: DEVOPS_API_KEY
    # LLM for comment summary (direct OpenAI call, no ACP agent)
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: OPENAI_API_KEY
      secretKey: OPENAI_API_KEY
    # GitHub token
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: SKILL_GITHUB_TOKEN
      secretKey: SKILL_GITHUB_TOKEN
    # AutoChat callback auth
    - remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: investibook-prod/config
        metadataPolicy: None
        property: CALLBACK_API_KEY
      secretKey: CALLBACK_API_KEY
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: default
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: investibook-config-secret