apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  labels:
    app: investibook
    app.kubernetes.io/instance: investibook
  name: investibook-config-secret
spec:
  data:
  # Lark / Feishu bot credentials
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: LARK_APP_ID
    secretKey: LARK_APP_ID
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: LARK_APP_SECRET
    secretKey: LARK_APP_SECRET
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: LARK_VERIFICATION_TOKEN
    secretKey: LARK_VERIFICATION_TOKEN
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: LARK_ENCRYPT_KEY
    secretKey: LARK_ENCRYPT_KEY
  # Jira credentials
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: JIRA_USERNAME
    secretKey: JIRA_USERNAME
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: JIRA_API_TOKEN
    secretKey: JIRA_API_TOKEN
  # Clinic credentials
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: CLINIC_API_KEY
    secretKey: CLINIC_API_KEY
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: SKILL_CLINIC_API_KEY
    secretKey: SKILL_CLINIC_API_KEY
  # DevOps skill credentials
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: DEVOPS_API_KEY
    secretKey: DEVOPS_API_KEY
  # Route-scoped identity for external alert ingestion
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: ALERT_INGEST_SERVICE_TOKEN
    secretKey: ALERT_INGEST_SERVICE_TOKEN
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: ALERT_INGEST_SERVICE_EMAIL
    secretKey: ALERT_INGEST_SERVICE_EMAIL
  # LLM for comment summary (direct OpenAI call, no ACP agent)
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: OPENAI_API_KEY
    secretKey: OPENAI_API_KEY
  # GitHub token
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: SKILL_GITHUB_TOKEN
    secretKey: SKILL_GITHUB_TOKEN
  # AutoChat callback auth
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: investibook-dev/config
      metadataPolicy: None
      property: CALLBACK_API_KEY
    secretKey: CALLBACK_API_KEY
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: default
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: investibook-config-secret