apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: crowdsec-secrets
  namespace: infisical
spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
    kubernetesAuth:
      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
      serviceAccountRef:
        name: infisical-auth
        namespace: infisical
      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/crowdsec"
        recursive: true
  managedSecretReference:
    secretName: crowdsec-secrets
    secretNamespace: crowdsec
    secretType: Opaque
# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)