---
# knoe-kdc-secrets.yaml
# Placeholder / example structure. Real values are created by init_knoe_auth.sh
# using 1Password (op) and applied directly — this file is NOT committed with
# real secrets.
#
# To create manually:
#   kubectl -n knoe-system create secret generic knoe-kdc-secrets \
#     --from-literal=master_password="$(op item get 'knoe-kdc-master' --fields password)" \
#     --from-literal=admin_password="$(op item get 'knoe-kdc-admin' --fields password)"
#
# Fields:
#   master_password  — KDC database master key (kdb5_util -P)
#   admin_password   — admin/admin@KNOE.DEV principal password (kadmin)
#
# Secret is referenced by:
#   - knoe-kdc (KDC sidecar container)
#   - keytab-bootstrap (initContainer)

apiVersion: v1
kind: Secret
metadata:
  name: knoe-kdc-secrets
  namespace: knoe-system
type: Opaque
stringData:
  master_password: "REPLACE_WITH_STRONG_RANDOM_VALUE"
  admin_password: "REPLACE_WITH_STRONG_RANDOM_VALUE"