apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata: { name: kasbot, namespace: default }
spec:
  refreshInterval: 1h
  target:
    name: kasbot-secrets
    deletionPolicy: Retain
    template:
      type: Opaque
      data:
        KASBOT_TOKEN: "{{ .KASBOT_TOKEN }}"
  data:
    - secretKey: KASBOT_TOKEN
      remoteRef:
        { key: 885a7d90-95be-494f-af88-300ac6a7e210, property: KASBOT_TOKEN }
      sourceRef:
        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }