# Kubernetes Secret template for Entra VerifiedID
# Use with External Secrets Operator or kubectl
apiVersion: v1
kind: Secret
metadata:
  name: entra-verifiedid-secrets
  namespace: the-order-prod
type: Opaque
stringData:
  # Microsoft Entra VerifiedID Configuration
  ENTRA_TENANT_ID: ""  # Replace with actual tenant ID
  ENTRA_CLIENT_ID: ""   # Replace with actual client ID
  ENTRA_CLIENT_SECRET: "" # Replace with actual client secret
  ENTRA_CREDENTIAL_MANIFEST_ID: "" # Replace with manifest ID
  
  # Multi-manifest support (JSON format)
  # ENTRA_MANIFESTS: '{"default":"id1","diplomatic":"id2","judicial":"id3","financial":"id4"}'
  
  # Rate Limiting (optional)
  ENTRA_RATE_LIMIT_ISSUANCE: "10"
  ENTRA_RATE_LIMIT_VERIFICATION: "20"
  ENTRA_RATE_LIMIT_STATUS_CHECK: "30"
  ENTRA_RATE_LIMIT_GLOBAL: "50"
---
# External Secret (if using External Secrets Operator)
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: entra-verifiedid-secrets
  namespace: the-order-prod
spec:
  secretStoreRef:
    name: azure-keyvault
    kind: SecretStore
  target:
    name: entra-verifiedid-secrets
    creationPolicy: Owner
  data:
    - secretKey: ENTRA_TENANT_ID
      remoteRef:
        key: entra-tenant-id
    - secretKey: ENTRA_CLIENT_ID
      remoteRef:
        key: entra-client-id
    - secretKey: ENTRA_CLIENT_SECRET
      remoteRef:
        key: entra-client-secret
    - secretKey: ENTRA_CREDENTIAL_MANIFEST_ID
      remoteRef:
        key: entra-credential-manifest-id

