# The admin API key. It is read from the environment, not from the ConfigMap,
# so the key never appears in `kubectl get configmap -o yaml`.
#
#   kubectl -n dns create secret generic fancy-dns-apikey \
#     --from-literal=api-key="$(openssl rand -hex 32)"
#
# With api_keys: ["${FANCYDNS_API_KEY}"] in the config, a missing
# FANCYDNS_API_KEY is a startup error rather than an empty key. These keys
# remain available for machine clients when the console uses OIDC.
apiVersion: v1
kind: Secret
metadata:
  name: fancy-dns-apikey
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
type: Opaque
stringData:
  # PLACEHOLDER — replace before this reaches a cluster. `kubectl apply` on this
  # file as-is will overwrite a real key with this value.
  api-key: REPLACE-ME