---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: eso-store
  namespace: argocd
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: eso-store
  namespace: argocd
rules:
  - apiGroups: [""]
    resources:
      - secrets
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - authorization.k8s.io
    resources:
      - selfsubjectrulesreviews
    verbs:
      - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: eso-store
  namespace: argocd
subjects:
  - kind: ServiceAccount
    name: eso-store
    namespace: argocd
roleRef:
  kind: Role
  name: eso-store
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: argocd
spec:
  provider:
    kubernetes:
      remoteNamespace: argocd
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          namespace: argocd
          key: ca.crt
      auth:
        serviceAccount:
          name: eso-store
          namespace: argocd
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: argocd-credentials
  namespace: backstage
spec:
  secretStoreRef:
    name: argocd
    kind: ClusterSecretStore
  refreshInterval: "0"
  target:
    name: argocd-credentials
  data:
    - secretKey: ARGOCD_ADMIN_PASSWORD
      remoteRef:
        key: argocd-initial-admin-secret
        property: password
