{{- if and .Values.externalSecrets.enabled .Values.externalDatabase.enabled .Values.externalSecrets.remoteRefs.externalDatabase.password }}
# ExternalSecret for external database password (syncs from external secret managers)
apiVersion: external-secrets.io/{{ .Values.externalSecrets.apiVersion | default "v1beta1" }}
kind: ExternalSecret
metadata:
  name: {{ include "sim.fullname" . }}-external-db-secret
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "sim.labels" . | nindent 4 }}
    app.kubernetes.io/component: external-database
spec:
  refreshInterval: {{ .Values.externalSecrets.refreshInterval | quote }}
  secretStoreRef:
    name: {{ required "externalSecrets.secretStoreRef.name is required when externalSecrets.enabled=true" .Values.externalSecrets.secretStoreRef.name }}
    kind: {{ .Values.externalSecrets.secretStoreRef.kind | default "ClusterSecretStore" }}
  target:
    name: {{ include "sim.fullname" . }}-external-db-secret
    creationPolicy: Owner
  data:
    - secretKey: EXTERNAL_DB_PASSWORD
      remoteRef:
        key: {{ .Values.externalSecrets.remoteRefs.externalDatabase.password }}
{{- end }}