apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultDynamicSecret
metadata:
  name: plausible-db-credentials
  namespace: tools
spec:

  # Mount path of the secrets backend
  mount: postgres

  # Path to the secret
  path: creds/plausible

  # Where to store the secrets, VSO will create the secret
  destination:
    create: true
    name: plausible-db-credentials

  # Restart these pods when secrets rotated
  rolloutRestartTargets:
  - kind: Deployment
    name: plausible

  # Name of the CRD to authenticate to Vault
  vaultAuthRef: plausible