# Purpose: Pulls secrets from GCP Secret Manager into Kubernetes
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: llm-trace-langfuse-db
spec:
  secretStoreRef:
    name: gcp-secret-manager  # ← References cluster secret store
  target:
    name: llm-trace-langfuse-db  # ← Creates this k8s secret
  data:
  - secretKey: database_url  # ← Maps to GCP secret
    remoteRef:
      key: xdev-llm-trace-langfuse-database-url