# Exercise 2: Keep secrets out of Git and lock down access (medium)
#
# Prereqs: kind cluster; External Secrets Operator installed via Helm
#   helm repo add external-secrets https://charts.external-secrets.io
#   helm install external-secrets external-secrets/external-secrets -n external-secrets --create-namespace
# For a local backend use the "fake" provider (no cloud account needed).
#
#   TODO 1: a SecretStore `local-fake` in namespace `payments` using the fake provider
#           with data: key "payments/stripe", value '{"api_key":"sk_test_123","webhook":"whsec_456"}'
#   TODO 2: an ExternalSecret `stripe` refreshing every 1m that creates the Secret
#           `stripe-credentials` with keys STRIPE_API_KEY and STRIPE_WEBHOOK_SECRET
#           (use remoteRef property to pick each JSON field)
#   TODO 3: a ServiceAccount `payments-api` and a Role allowing `get` on ONLY the
#           Secret named stripe-credentials (resourceNames), bound to the SA
#   TODO 4: a Deployment `payments-api` (1 replica, busybox:1.36, sleep loop) using that
#           SA, mounting stripe-credentials as files at /var/run/secrets/stripe,
#           automountServiceAccountToken: false
#   TODO 5: a comment block: how the same ExternalSecret would point at AWS Secrets
#           Manager in production (ClusterSecretStore with Pod Identity / IRSA), and
#           how you'd enable etcd encryption on EKS.
#
# CHECKLIST:
# [ ] kubectl get externalsecret stripe -n payments → STATUS SecretSynced.
# [ ] Secret stripe-credentials contains the two keys (decode with base64 -d).
# [ ] kubectl auth can-i get secret/stripe-credentials --as=system:serviceaccount:payments:payments-api → yes
# [ ] ... get secret/other or list secrets → no.
# [ ] No secret value appears anywhere in this file except the fake provider data.
apiVersion: v1
kind: Namespace
metadata:
  name: payments
---
# TODO 1: SecretStore
# ---
# TODO 2: ExternalSecret
# ---
# TODO 3: ServiceAccount, Role, RoleBinding
# ---
# TODO 4: Deployment
# TODO 5: production notes