# MQTT broker creds for the web container, synced from OpenBao by VSO.
#
# Reads secret/home_assistant (keys mqtt_user / mqtt_pass) and renders a k8s
# Secret `jbod-mqtt` with MQTT_USERNAME / MQTT_PASSWORD keys (consumed via
# envFrom in the DaemonSet). VSO's `vso-read` policy can read secret/data/*,
# so unlike the claude-read token it CAN read home_assistant — no creds ever
# touch these manifests.
#
# Verify the transformation syntax against the installed VSO version.
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: jbod-mqtt
  namespace: jbod-monitor
spec:
  vaultAuthRef: vault-secrets-operator-system/openbao-kubernetes
  mount: secret
  type: kv-v2
  path: home_assistant
  refreshAfter: 1h
  destination:
    name: jbod-mqtt
    create: true
    transformation:
      excludeRaw: true
      templates:
        MQTT_USERNAME:
          text: '{{ .Secrets.mqtt_user }}'
        MQTT_PASSWORD:
          text: '{{ .Secrets.mqtt_pass }}'