apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: vso-db
  namespace: {{ .Release.Namespace }}
spec:

  # Mount path of the secrets backend
  mount: postgres

  # Path to the secret
  path: creds/erp

  # Where to store the secrets, VSO will create the secret
  destination:
    create: true
    name: vso-db-credentials

  # Restart these pods when secrets rotated
  rolloutRestartTargets:
  - kind: Deployment
    name: {{ include "erp.fullname" . }}

  # Name of the CRD to authenticate to Vault
  vaultAuthRef: auth