# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/externaldns/cloudflare-api-token.sops.yaml
#                   (component DIR is platform/externaldns/, but the Kubernetes
#                    NAMESPACE is external-dns — note the hyphen.)
# (b) kustomization: add this line under `resources:` in
#                    platform/externaldns/kustomization.yaml
#                       - cloudflare-api-token.sops.yaml
# (c) Encrypt:       sops -e -i platform/externaldns/cloudflare-api-token.sops.yaml
# (d) Consumed by:   external-dns reads env CF_API_TOKEN via secretKeyRef
#                    name `cloudflare-api-token`, key `api-token`. [Phase 2]
#
# NOTE: This is the SAME Cloudflare token as the cert-manager copy — just a
# second copy living in the external-dns namespace. ClusterIssuer secrets and
# external-dns run in different namespaces, so the token must exist in both. A
# single Cloudflare API token with Zone:DNS:Edit + Zone:Read scope serves both.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
    name: cloudflare-api-token
    namespace: external-dns
type: Opaque
stringData:
    api-token: ENC[AES256_GCM,data:8+4CNm8QZh4Q8Z33r+YRKXUlh7CGHzSaXcUEC9pWbGhyaAeAbea8mFm3eXVxKqbmuclgiYw=,iv:1NsSyjiH1ZU7Nh9FW9aBGhmY5KDB9koKFx+T8aeSd4k=,tag:GVL5/EWJW6TmSGo9wDGJ5w==,type:str]
sops:
    kms: []
    gcp_kms: []
    azure_kv: []
    hc_vault: []
    age:
        - recipient: age175l8mdpdfu7hq0aml3exs3gykarwjmuvr23sq56s3wjejnyk44wsp4mfzg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqcEdxSklUSWkwVHJqRU5S
            NEJuZjc1L0VkeStQdTJtS3RuRnpwUTIwMFNnClFzaFE3SDRXN0NIL3AzSzVmcjlL
            N0RPb1FNR1UzNVFMbVFXSFA5bkZ6ZmcKLS0tIGNKbG1yRGN4QW91aEgwSDJuN2t6
            blFCdXlLVDBGK3JESGhuME5QeVRpOE0Ke9WNjV8CSEdzelFyhn/ZWCUJfAhwSZcf
            KE2ms+cJ7cR6hSjLFQWal6Rbt4fX7qogPtWSpQ1pR3+8F/00X6ruTw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-08-17T03:56:14Z"
    mac: ENC[AES256_GCM,data:Hr2Q0EuzUbF08yE6pK34FbJ8hBWDoKuNnqzB4TZsauLKz9ZUHq0A+UKNX6oG+PNUujSTGf3BlyY4hffNWrH5mcGAA7k9yWpqUKDdALlde89X3KqVckUe7RWHLgcz7h8pDSr3kekoowXc49XtGS86ArqulEnH4QdwoPcHNvo/qwI=,iv:aC/dU2zQ1oK8SxndVJw81URPe2rgH6KJTsvh/K4K8jY=,tag:bIuEtbB+p294EqxzqX3D9Q==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.4