# Example only. Create these values through a secret manager before applying
# the CloudNativePG resources. Never commit a populated copy.
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-migration-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_migration
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-ai-maintenance-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_ai_maintenance
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-ai-credential-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_ai_credential_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-ai-credential-tester-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_ai_credential_tester
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-runtime-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_runtime
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-admin-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_admin
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-package-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_package_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-package-executor-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_package_executor
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-automation-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_automation_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-approval-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_approval_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-run-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_run_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-worker-credential-manager-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_worker_credential_manager
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-worker-credential-executor-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_worker_credential_executor
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-postgres-worker-ingress-auth
  namespace: qinglong3-system
  labels:
    cnpg.io/reload: 'true'
type: kubernetes.io/basic-auth
stringData:
  username: ql3_worker_ingress
  password: REPLACE_WITH_SECRET_MANAGER_VALUE
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-control-runtime
  namespace: qinglong3-system
type: Opaque
stringData:
  api-credential-pepper: REPLACE_WITH_CANONICAL_32_BYTE_BASE64URL
---
apiVersion: v1
kind: Secret
metadata:
  name: ql3-cluster-worker-ingress
  namespace: qinglong3-system
type: Opaque
stringData:
  worker-credential-pepper: REPLACE_WITH_DISTINCT_CANONICAL_32_BYTE_BASE64URL
  artifact-s3-bucket: REPLACE_WITH_PRIVATE_IMMUTABLE_ARTIFACT_BUCKET
  artifact-s3-region: REPLACE_WITH_BUCKET_REGION
  artifact-s3-encryption: s3
  tls.key: |
    -----BEGIN PRIVATE KEY-----
    REPLACE_WITH_WORKER_INGRESS_SERVER_PRIVATE_KEY
    -----END PRIVATE KEY-----
  tls.crt: |
    -----BEGIN CERTIFICATE-----
    REPLACE_WITH_WORKER_INGRESS_SERVER_CERTIFICATE_CHAIN
    -----END CERTIFICATE-----
  client-ca.crt: |
    -----BEGIN CERTIFICATE-----
    REPLACE_WITH_WORKER_CLIENT_CA_BUNDLE
    -----END CERTIFICATE-----