apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: webhook-es
  namespace: argocd
spec:
  refreshInterval: "15s"
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  target:
    template:
      data:
        webhook.github.secret: "{{ .webhook_secret | toString }}"
        oidc.authentik.clientSecret: "{{ .oidc_client_secret | toString }}"
    name: argocd-secret
    creationPolicy: Merge
  data:
  - secretKey: webhook_secret
    remoteRef:
      key: github_secret
  - secretKey: oidc_client_secret
    remoteRef:
      key: kv/argocd-oidc
      property: client_secret