# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-snapshot-agent-token
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-snapshot-agent-token
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: snapshot
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: VAULT_APPROLE_ROLE_ID
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/snapshot/approle
#         metadataPolicy: None
#         property: role-id
#     - secretKey: VAULT_APPROLE_SECRET_ID
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/snapshot/approle
#         metadataPolicy: None
#         property: secret-id

# ---
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-snapshot-s3
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-snapshot-s3
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: snapshot
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: AWS_ACCESS_KEY_ID
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /digital-ocean/home-infra/vault-backup
#         metadataPolicy: None
#         property: AWS_ACCESS_KEY_ID
#     - secretKey: AWS_DEFAULT_REGION
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /digital-ocean/home-infra/vault-backup
#         metadataPolicy: None
#         property: AWS_DEFAULT_REGION
#     - secretKey: AWS_ENDPOINT_URL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /digital-ocean/home-infra/vault-backup
#         metadataPolicy: None
#         property: AWS_ENDPOINT_URL
#     - secretKey: AWS_SECRET_ACCESS_KEY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /digital-ocean/home-infra/vault-backup
#         metadataPolicy: None
#         property: AWS_SECRET_ACCESS_KEY

# ---
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-unseal-config-1
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-unseal-key-1
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: unseal
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: ENVIRONMENT
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: ENVIRONMENT
#     - secretKey: CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: CHECK_INTERVAL
#     - secretKey: MAX_CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: MAX_CHECK_INTERVAL
#     - secretKey: NODES
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: NODES
#     - secretKey: TLS_SKIP_VERIFY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: TLS_SKIP_VERIFY
#     - secretKey: TOKENS
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: TOKENS
#     - secretKey: EMAIL_ENABLED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: EMAIL_ENABLED
#     - secretKey: NOTIFY_MAX_ELAPSED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: NOTIFY_MAX_ELAPSED
#     - secretKey: NOTIFY_QUEUE_DELAY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-1
#         metadataPolicy: None
#         property: NOTIFY_QUEUE_DELAY

# ---
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-unseal-config-2
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-unseal-key-2
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: unseal
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: ENVIRONMENT
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: ENVIRONMENT
#     - secretKey: CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: CHECK_INTERVAL
#     - secretKey: MAX_CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: MAX_CHECK_INTERVAL
#     - secretKey: NODES
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: NODES
#     - secretKey: TLS_SKIP_VERIFY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: TLS_SKIP_VERIFY
#     - secretKey: TOKENS
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: TOKENS
#     - secretKey: EMAIL_ENABLED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: EMAIL_ENABLED
#     - secretKey: NOTIFY_MAX_ELAPSED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: NOTIFY_MAX_ELAPSED
#     - secretKey: NOTIFY_QUEUE_DELAY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-2
#         metadataPolicy: None
#         property: NOTIFY_QUEUE_DELAY

# ---
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-unseal-config-3
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-unseal-config-3
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: unseal
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: ENVIRONMENT
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: ENVIRONMENT
#     - secretKey: CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: CHECK_INTERVAL
#     - secretKey: MAX_CHECK_INTERVAL
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: MAX_CHECK_INTERVAL
#     - secretKey: NODES
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: NODES
#     - secretKey: TLS_SKIP_VERIFY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: TLS_SKIP_VERIFY
#     - secretKey: TOKENS
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: TOKENS
#     - secretKey: EMAIL_ENABLED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: EMAIL_ENABLED
#     - secretKey: NOTIFY_MAX_ELAPSED
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: NOTIFY_MAX_ELAPSED
#     - secretKey: NOTIFY_QUEUE_DELAY
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/unseal/config-3
#         metadataPolicy: None
#         property: NOTIFY_QUEUE_DELAY

# ---
# apiVersion: external-secrets.io/v1beta1
# kind: ExternalSecret
# metadata:
#   name: vault-token
#   namespace: {{ .Release.Namespace }}
#   labels:
#     app.kubernetes.io/name: vault-token
#     app.kubernetes.io/instance: {{ .Release.Name }}
#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
#     app.kubernetes.io/component: token
#     app.kubernetes.io/part-of: {{ .Release.Name }}
# spec:
#   secretStoreRef:
#     kind: ClusterSecretStore
#     name: vault
#   data:
#     - secretKey: token
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: token
#     - secretKey: unseal_key_1
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: unseal_key_1
#     - secretKey: unseal_key_2
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: unseal_key_2
#     - secretKey: unseal_key_3
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: unseal_key_3
#     - secretKey: unseal_key_4
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: unseal_key_4
#     - secretKey: unseal_key_5
#       remoteRef:
#         conversionStrategy: Default
#         decodingStrategy: None
#         key: /cl01tl/vault/token
#         metadataPolicy: None
#         property: unseal_key_5