# Example of Secret-level vault synchronization
# This demonstrates how to annotate Secrets directly for Vault sync without needing a Deployment

---
# Example 1: Sync all keys from a Secret to Vault
apiVersion: v1
kind: Secret
metadata:
  name: database-credentials
  namespace: default
  annotations:
    vault-sync.io/path: "secret/data/production/database"
    # No vault-sync.io/secrets annotation = sync ALL keys from this secret
type: Opaque
data:
  username: cG9zdGdyZXM=      # base64 encoded "postgres"
  password: c3VwZXJzZWNyZXQ=  # base64 encoded "supersecret"
  host: bG9jYWxob3N0        # base64 encoded "localhost"
  port: NTQzMg==            # base64 encoded "5432"
  database: bXlkYg==         # base64 encoded "mydb"

---
# Example 2: Sync specific keys with prefixes
apiVersion: v1
kind: Secret
metadata:
  name: api-credentials
  namespace: default
  annotations:
    vault-sync.io/path: "secret/data/production/api"
    vault-sync.io/secrets: |
      [
        {
          "name": "api-credentials",
          "keys": ["api_key", "secret_key"],
          "prefix": "production_"
        }
      ]
type: Opaque
data:
  api_key: YWJjZGVmZ2g=      # base64 encoded "abcdefgh"
  secret_key: eHl6MTIz        # base64 encoded "xyz123"
  internal_token: aW50ZXJuYWw=  # base64 encoded "internal" - not synced
  debug_flag: dHJ1ZQ==        # base64 encoded "true" - not synced

---
# Example 3: Secret with preservation and reconciliation settings
apiVersion: v1
kind: Secret
metadata:
  name: shared-config
  namespace: default
  annotations:
    vault-sync.io/path: "secret/data/shared/config"
    vault-sync.io/preserve-on-delete: "true"
    vault-sync.io/reconcile: "5m"
    vault-sync.io/rotation-check: "enabled"
type: Opaque
data:
  encryption_key: c29tZWVuY3J5cHRpb25rZXk=  # base64 encoded "someencryptionkey"
  signing_key: c29tZXNpZ25pbmdrZXk=        # base64 encoded "somesigningkey"
  public_key: c29tZXB1YmxpY2tleQ==         # base64 encoded "somepublickey"

---
# Example 4: Multi-environment secret with selective sync
apiVersion: v1
kind: Secret
metadata:
  name: app-secrets
  namespace: staging
  annotations:
    vault-sync.io/path: "secret/data/staging/application"
    vault-sync.io/secrets: |
      [
        {
          "name": "app-secrets",
          "keys": ["db_user", "db_password", "redis_url"],
          "prefix": "staging_"
        }
      ]
type: Opaque
data:
  db_user: c3RhZ2luZ191c2Vy          # base64 encoded "staging_user"
  db_password: c3RhZ2luZ19wYXNzd29yZA==  # base64 encoded "staging_password"
  redis_url: cmVkaXM6Ly9zdGFnaW5n      # base64 encoded "redis://staging"
  local_dev_token: bG9jYWw=           # base64 encoded "local" - not synced
  test_flag: ZmFsc2U=                 # base64 encoded "false" - not synced

---
# Example 5: Secret with rotation check disabled
apiVersion: v1
kind: Secret
metadata:
  name: static-config
  namespace: default
  annotations:
    vault-sync.io/path: "secret/data/static/configuration"
    vault-sync.io/rotation-check: "disabled"
    # With rotation check disabled, the secret will be synced on every reconciliation
type: Opaque
data:
  feature_flags: eyJuZXdfZmVhdHVyZSI6dHJ1ZX0=  # base64 encoded '{"new_feature":true}'
  app_version: djEuMi4z                        # base64 encoded "v1.2.3"