# The admin API key. It is read from the environment, not from the ConfigMap,
# so the key never appears in `kubectl get configmap -o yaml`.
#
#   kubectl -n dns create secret generic fancy-dns-apikey \
#     --from-literal=api-key="$(openssl rand -hex 32)"
#
# With auth.mode: apikey and api_keys: ["${FANCYDNS_API_KEY}"] in the config,
# a missing FANCYDNS_API_KEY is a startup error rather than an empty key, so a
# forgotten secret shows up as a CrashLoopBackOff and not as an unauthenticated
# console on the network.
apiVersion: v1
kind: Secret
metadata:
  name: fancy-dns-apikey
  namespace: dns
  labels:
    app.kubernetes.io/name: fancy-dns
type: Opaque
stringData:
  # PLACEHOLDER — replace before this reaches a cluster. `kubectl apply` on this
  # file as-is will overwrite a real key with this value.
  api-key: REPLACE-ME