# Create these objects through the deployment's Secret authority; do not commit
# real CA or token material. The Vault token must be an orphan, non-renewable
# service token with only ql3-worker-secret-read and at most a 15-minute TTL.
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-worker-vault-trust
  namespace: qinglong3-system
type: Opaque
stringData:
  ca.pem: REPLACE_WITH_PRIVATE_VAULT_CA_PEM
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-worker-vault-auth
  namespace: qinglong3-system
type: Opaque
stringData:
  token: REPLACE_WITH_SHORT_LIVED_ORPHAN_VAULT_TOKEN