secrets

type ResolvedSecretSpec struct {
	// Name — Secret name. Required.
	Name string

	// Namespace — target namespace. Required.
	Namespace string

	// StringData — static key-value entries.
	// Values are plain strings — template expressions are not supported here.
	StringData map[string]string

	// Data
	Data map[string][]byte

	// Type — Kubernetes Secret type.
	// Default: "Opaque"
	Type string

	// FromSecret — name of a source Secret to copy from.
	// When set, copies all keys from the source into the target.
	// Individual Data entries merge on top — override specific keys if needed.
	FromSecret string

	// FromNamespace — namespace where FromSecret lives.
	// Default: same namespace as the CR.
	FromNamespace string

	// Labels — applied to Secret metadata.
	Labels map[string]string

	// Annotations — applied to Secret metadata.
	Annotations map[string]string

	// Sleep injects an artificial delay into the reconcile of this resource.
	// Useful for autoscale testing, latency simulation, and chaos engineering.
	// Accepts extended duration units (s, m, h, d, w, mo, y).
	Sleep string
}

type SecretTemplateSource struct {
	// Version — OrkestraRegistry implementation version. Omit for latest.
	Version string

	// Name — Secret name in the target namespace.
	// Default: "{{ .metadata.name }}-secret"
	Name string

	// Namespace — primary target namespace.
	// Default: "{{ .metadata.namespace }}"
	// When ToNamespaces is set, this field is ignored.
	Namespace string

	// ToNamespaces — create one copy of this Secret in each listed namespace.
	// Each element supports template expressions.
	// e.g. ["{{ .metadata.namespace }}", "monitoring", "staging"]
	// When set, Namespace is ignored — ToNamespaces controls all target namespaces.
	ToNamespaces []string

	// FromSecret — name of an existing Secret to copy data from.
	// When set, Orkestra reads this Secret at reconcile time and copies its data.
	// This means the copy stays in sync — if the source changes, the copy updates.
	// Omit to use static Data entries instead.
	FromSecret string

	// FromNamespace — namespace where FromSecret lives.
	// Default: same namespace as the CR.
	FromNamespace string

	// Data — static key-value Secret entries (string values).
	// Kubernetes encodes them to base64 automatically.
	// When FromSecret is also set, these entries override matching keys from the source.
	Data map[string]string

	// Type — Kubernetes Secret type.
	// Default: Opaque.
	// e.g. "kubernetes.io/tls", "kubernetes.io/dockerconfigjson"
	Type string

	// Labels — applied to all created Secret copies.
	Labels []orktypes.ResourceLabel

	// Reconcile: true — also sync on every reconcile (drift correction).
	// When true, if the source Secret changes, all copies are updated automatically.
	Reconcile bool

	// Sleep injects an artificial delay into the reconcile of this resource.
	// Useful for autoscale testing, latency simulation, and chaos engineering.
	// Accepts extended duration units (s, m, h, d, w, mo, y).
	Sleep string
}