apiVersion: secrets.infisical.com/v1alpha1
kind: InfisicalSecret
metadata:
  name: gitea-secrets
  namespace: infisical
spec:
  hostAPI: https://infisical.jsme.be
  resyncInterval: 30
  authentication:
    kubernetesAuth:
      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
      serviceAccountRef:
        name: infisical-auth
        namespace: infisical
      autoCreateServiceAccountToken: true
      secretsScope:
        projectSlug: "kubernetes"
        envSlug: "prod"
        secretsPath: "/gitea"
        # Root only: /gitea holds the SMB mount credentials and the Actions runner token.
        # Per-container env lives in subfolders.
        recursive: false
  managedSecretReference:
    secretName: gitea-secrets
    secretNamespace: gitea
    secretType: Opaque