environments:
    yc-k8s-test:
        # vault-platform-secrets stack input. Inert for now (enabled:false) so it does
        # NOT touch existing bootstrap creds already present in the contour Vault.
        # kv_mount/path_prefix are also used by the secrets stack for sink=vault.
        vault:
            enabled: false
            kv_mount: secrets
            path_prefix: vault
            kubernetes_auth_backend: kubernetes
            default_rsa_bits: 4096
            features:
                create_regcred: false
                create_smtp_auth: false
                create_django_auth: false
                create_rsa_keys: false
                create_infra_secrets: false
                create_infra_policies: false
                create_infra_roles: false
                create_app_policies: false
                create_app_roles: false
            common: {}
            infrastructure: {}
            applications: {}
        secrets:
            # 1) static secret -> k8s Secret (keys declared here, base64 as in k8s .data)
            - name: test-static-k8s
              namespace: contour
              type: opaque
              sink: k8s
              lifecycle:
                ignore_changes: false
              data:
                test-key: ENC[AES256_GCM,data:7oQuOfbWEIg9TrJoxEOYiw==,iv:gO1XJvtxQX1jL5xq5AR3TIYhBcNUUTJNNnFKCvEUr8o=,tag:/i3mdEXQgJ5QNoMgA9k+NQ==,type:str]
            # 2) dynamic secret -> k8s Secret, from the in-cluster database outputs
            - name: test-db-k8s
              namespace: contour
              type: database
              sink: k8s
              depends_on:
                cluster: incluster
                db: test_db
                user: test_user
              lifecycle:
                ignore_changes: false
            # 3) static secret -> Vault KV (secrets/vault/test/static)
            - name: test-static-vault
              namespace: contour
              type: opaque
              sink: vault
              vault_path: vault/test/static
              lifecycle:
                ignore_changes: false
              data:
                test-key: ENC[AES256_GCM,data:4/MZysB8/zUfq7OhIWemhg==,iv:l9SXydQYvyO4ZrMnxjAI6P0XKi4ygrzm5Xdl6SYe0Ww=,tag:/rqrbx2tB6/YyAcIs+gXTg==,type:str]
            # 4) dynamic secret -> Vault KV (secrets/vault/test/bucket), from MinIO bucket outputs
            - name: test-bucket-vault
              namespace: contour
              type: s3
              sink: vault
              vault_path: vault/test/bucket
              depends_on:
                bucket: test-bucket
              lifecycle:
                ignore_changes: false
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age198ea80z7gan2ruetn288ln6rl2qh7xtsqqpwrjtyn8maya3364fsvpdd63
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhV2MybDRmMk53WHZITWYz
            UmtYbHVYRFd3WnpaQkE0bVo4Z2d2OTNVWHgwCmpjL0hhTTBIZmNsNWxLSDRnTlh3
            eHc1Y2R5cXFBK3hPbTJsZDFEWGJHOEkKLS0tIG5FdmNVMUlxbnJ3UEx3eUpSdTho
            TFZIaWFBa2ZObmxubFFsUm8vYmI2MTAK+WOHWtrSphcvR/91FhFFb8qksmS4IcIn
            oBVNWWvyF2WlEmgfFchamyRwUDrLfC0I3Jox5mPKsSg4ocZ/cCQoKQ==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-07-16T13:35:36Z"
    mac: ENC[AES256_GCM,data:/Q4nThM0z/42iC6RY1wp8OdjCFz09kCbfwAFJkqnXSN0OQtbAjwrCTWiF3ix0QrfdwWjU7LEWga6knWH+b6UrXv9naVHeDjmSNjrDzVn9AWVMklgSn++1lr9dtmtE0dA0qET4rUrfDaVgHn4HATaC2WaasJnorccs55j0SNuHlc=,iv:TnXfidgw05JVC1Cuv15v3bTZHPyH2c60sOQstH0NxrA=,tag:Sjd4R/79ZUKIt2zxBDLLqA==,type:str]
    pgp: []
    encrypted_regex: ^(data)$
    version: 3.9.0