apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: infisicalsecret-sample
  labels:
    label-to-be-passed-to-managed-secret: sample-value
  annotations:
    example.com/annotation-to-be-passed-to-managed-secret: "sample-value"
spec:
  hostAPI: http://localhost:8080/api
  resyncInterval: 10
  # tls:
  #   caRef:
  #     secretName: custom-ca-certificate
  #     secretNamespace: default
  #     key: ca.crt
  authentication:
    # Universal Auth
    universalAuth:
      secretsScope:
        projectSlug: hello-9zkr
        envSlug: dev # "dev", "staging", "prod", etc..
        secretsPath: "/" # Root is "/"
        recursive: true # Wether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
      credentialsRef:
        secretName: universal-auth-credentials
        secretNamespace: default

    # Native Kubernetes Auth
    kubernetesAuth:
      serviceAccountRef:
        name: <secret-name>
        namespace: <secret-namespace>
      identityId: <machine-identity-id>
      serviceAccountTokenPath: "/path/to/your/service-account/token" # Optional, defaults to /var/run/secrets/kubernetes.io/serviceaccount/token

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

    # AWS IAM Auth
    awsIamAuth:
      identityId: <your-machine-identity-id>

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

    ldapAuth:
      identityId: <machine-identity-id>
      credentialsRef:
        secretName: <secret-name> # ldap-auth-credentials
        secretNamespace: <secret-namespace> # default

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

    # Azure Auth
    azureAuth:
      identityId: <your-machine-identity-id>
      resource: https://management.azure.com/&client_id=your_client_id # This field is optional, and will default to "https://management.azure.com/" if nothing is provided.

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

    # GCP ID Token Auth
    gcpIdTokenAuth:
      identityId: <your-machine-identity-id>

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

    # GCP IAM Auth
    gcpIamAuth:
      identityId: <your-machine-identity-id>
      serviceAccountKeyFilePath: "/path/to-service-account-key-file-path.json"

      # secretsScope is identical to the secrets scope in the universalAuth field in this sample.
      secretsScope:
        projectSlug: your-project-slug
        envSlug: prod
        secretsPath: "/path"
        recursive: true

  managedKubeSecretReferences:
    - secretName: managed-secret
      secretNamespace: default
      creationPolicy: "Orphan" ## Owner | Orphan