{#
  Managed by Ansible (roles/k3s_app) — do not edit on the node.

  The k3s counterpart of compose_stack's rendered .env: every key from the
  app's Vault path, verbatim, in one Secret the app's manifests reference by
  name. Keys are not renamed or filtered on the way through, which is what
  keeps this role generic — an app decides what its environment looks like by
  choosing its Vault keys, exactly as it does on Unraid, and the role stays
  ignorant of any particular app's variables.

  The intended consumer is an envFrom/secretRef in the app's own manifest,
  so the values become environment variables without ever being named in a
  committed file. See src/authentik/ansible/kubernetes/ for the worked
  example.

  Namespace lives here rather than in the app's manifests so it's guaranteed
  to exist before anything mounts this Secret — a HelmChart CR's
  createNamespace: true happens when the chart installs, which is after the
  helm-controller job needs somewhere to put it.
-#}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ app_config.K8S_NAMESPACE }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ app.name }}-secrets
  namespace: {{ app_config.K8S_NAMESPACE }}
type: Opaque
stringData:
{% for key, value in (app_vault_secrets | default({})) | dictsort %}
  {{ key }}: {{ value | string | to_json }}
{% endfor %}