# TEMPLATE ONLY — do NOT commit a real key. The real secret is created
# out-of-band and is deliberately excluded from kustomization.yaml so no key
# lands in git.
#
# Secret shape: `tidaldb-credentials` with up to THREE keys:
#   - TIDAL_API_KEY    — the DATA-PLANE bearer. Every pod and every external
#     client uses this one (forwarded requests pass the caller's Authorization
#     verbatim). Hand this to applications.
#   - TIDAL_ADMIN_KEY  — OPTIONAL but strongly recommended: the OPERATOR
#     credential. Without it the destructive verbs (/cluster/promote,
#     /cluster/partition, /cluster/heal, /cluster/members/remove,
#     /cluster/reseed, /cluster/shards/*) accept the DATA bearer, so any
#     application key can remove a member or move a shard. With it they require
#     this key (or a verified sibling node token) and the data bearer gets 403.
#     It is a SUPERSET credential - it also authenticates the data routes - so
#     keep it off application hosts. Mounted as a FILE
#     (TIDAL_ADMIN_KEY_FILE) so rotation needs no restart.
#   - TIDAL_CLUSTER_KEY — m11p7: the SHARED CLUSTER KEY. Mints/verifies per-node
#     signed internal tokens so inter-node HTTP carries verifiable node identity
#     and the x-tidal-internal marker is honored ONLY from a verified sibling.
#     Mounted as a FILE (TIDAL_CLUSTER_KEY_FILE) so a rotation is hot (no restart).
#     Known ONLY to cluster pods — never hand it to external clients.
#
# Create the real one (do not apply this file):
#   kubectl -n tidaldb-cluster create secret generic tidaldb-credentials \
#     --from-literal=TIDAL_API_KEY="$(openssl rand -hex 32)" \
#     --from-literal=TIDAL_ADMIN_KEY="$(openssl rand -hex 32)" \
#     --from-literal=TIDAL_CLUSTER_KEY="$(openssl rand -hex 32)"
#
# Inter-node TLS material is a SEPARATE Secret (`tidaldb-cluster-tls`), issued by
# cert-manager (certs.yaml) or provisioned with scripts/gen-cluster-certs.sh.
#
# In production manage these with External Secrets Operator / Sealed Secrets /
# Vault. An empty TIDAL_API_KEY runs UNAUTHENTICATED (WARN); an absent
# TIDAL_CLUSTER_KEY disables per-node tokens (the marker keeps hint-only
# behavior, WARN) — never do either on a shared network.
apiVersion: v1
kind: Secret
metadata:
  name: tidaldb-credentials
  namespace: tidaldb-cluster
  labels:
    app.kubernetes.io/name: tidaldb
    app.kubernetes.io/part-of: tidaldb
type: Opaque
stringData:
  TIDAL_API_KEY: "replace-me-do-not-commit"
  TIDAL_ADMIN_KEY: "replace-me-do-not-commit-distinct-from-api-key"
  TIDAL_CLUSTER_KEY: "replace-me-do-not-commit-distinct-from-api-key"