# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/externaldns/cloudflare-api-token.sops.yaml
#                   (component DIR is platform/externaldns/, but the Kubernetes
#                    NAMESPACE is external-dns — note the hyphen.)
# (b) kustomization: add this line under `resources:` in
#                    platform/externaldns/kustomization.yaml
#                       - cloudflare-api-token.sops.yaml
# (c) Encrypt:       sops -e -i platform/externaldns/cloudflare-api-token.sops.yaml
# (d) Consumed by:   external-dns reads env CF_API_TOKEN via secretKeyRef
#                    name `cloudflare-api-token`, key `api-token`. [Phase 2]
#
# NOTE: This is the SAME Cloudflare token as the cert-manager copy — just a
# second copy living in the external-dns namespace. ClusterIssuer secrets and
# external-dns run in different namespaces, so the token must exist in both. A
# single Cloudflare API token with Zone:DNS:Edit + Zone:Read scope serves both.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: cloudflare-api-token
  namespace: external-dns
type: Opaque
stringData:
  api-token: REPLACE-ME-CLOUDFLARE-DNS-EDIT-TOKEN