version: 1
kind: hwlab-v03-secret-plane
metadata:
  id: hwlab-v03-secret-plane
  owner: HWLAB
  spec: pikasTech/HWLAB#2277
  boundary: JD01/v0.3 read-only active target
secretPlane:
  enabled: true
  issue: pikasTech/HWLAB#2277
  enabledOnNodes:
    - JD01
  valuesPrinted: false
  readModel:
    target:
      node: JD01
      lane: v03
      runtimeNamespace: hwlab-v03
      infraNamespace: platform-infra
      publicUrl: https://hwlab.pikapython.com
      source: yaml-active-target
      sourceRef: config/hwlab-v03/secrets.yaml#secretPlane.readModel.target
      upstreamSourceRef: config/platform-infra/secret-plane.yaml#activeTarget
    statusEvidence:
      source: pikasTech/unidesk#1282
      issue: pikasTech/HWLAB#2277
      command: bun scripts/cli.ts platform-infra secret-plane status --target JD01
      validatedAt: "2026-06-30T03:21:49Z"
      fingerprint: sha256:dbc852e80ed37ccc9d8596eb47976839c9c77e4a5afda972ce62ad29db9132dd
      status: Ready
      valuesPrinted: false
      components:
        esoController: Ready
        esoWebhook: Ready
        esoCertController: Ready
        secretStore: Ready
        clusterSecretStore: Ready
        sync: Ready
        consumer: Ready
  store:
    kind: ClusterSecretStore
    name: hwlab-secret-plane-vault-cluster
  refreshInterval: 1m
  secrets:
    - id: hwlab-secret-plane-smoke
      externalSecretName: hwlab-secret-plane-smoke
      targetSecretName: hwlab-secret-plane-smoke
      purpose: Low-risk JD01/v0.3 smoke secret for platform-infra secret-plane integration.
      statusEvidence:
        status: Ready
        reason: JD01 platform-infra secret-plane PoC validated by pikasTech/unidesk#1282.
        fingerprint: sha256:dbc852e80ed37ccc9d8596eb47976839c9c77e4a5afda972ce62ad29db9132dd
      data:
        - targetKey: password
          remoteRef: hwlab-secret-plane/poc
          property: password
      consumers:
        - serviceId: hwlab-cloud-api
          kind: Deployment
          injectAs: env
          envName: HWLAB_SECRET_PLANE_SMOKE
    - id: test-1
      externalSecretName: test-1
      targetSecretName: test-1
      purpose: User-requested low-risk test ExternalSecret for ESO UI validation.
      statusEvidence:
        status: Ready
        reason: JD01 test ExternalSecret source material was written to Vault KV v2 without printing values.
        fingerprint: sha256:64056d77d3a430f947337d73e3002deb5f474e49390f9f88f32156def6be95a7
      data:
        - targetKey: password
          remoteRef: hwlab-secret-plane/test-1
          property: password
      consumers: []
