apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: affine, namespace: cloud }
spec:
  refreshInterval: 1h
  target:
    name: affine-secret
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        DB_USERNAME: "{{ .DB_USERNAME }}"
        DB_PASSWORD: "{{ .DB_PASSWORD }}"
        DB_NAME: "{{ .DB_NAME }}"
  data:
    - secretKey: DB_USERNAME
      remoteRef:
        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: username }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: DB_PASSWORD
      remoteRef:
        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: password }
      sourceRef:
        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
    - secretKey: DB_NAME
      remoteRef:
        { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }