# Fixtures for the valkey install-test: the one Secret the 1Password operator
# would otherwise materialize from the OnePasswordItem the chart renders
# (release name: ci, stub CRD in ci/common/).
#
# The field name matters as much as the value. The chart mounts exactly the key
# "auth-conf" and its content has to be a COMPLETE Valkey configuration line,
# because the configuration "include"s the file - so this fixture is also what
# keeps the init container's check honest: give it anything that is not a
# "requirepass <password>" line and the pod refuses to start, which is the
# failure this chart exists to make loud.
#
# No throwaway infrastructure here: Valkey depends on nothing. What this
# install-test does exercise, and why it is the persistent variant, is the risky
# path - a provisioned PVC, the pod's fsGroup against it, and an append-only
# file being created and replayed on a volume the container did not create.
apiVersion: v1
kind: Secret
metadata:
  name: ci-valkey-secret
stringData:
  # A throwaway password. Nothing here survives the run - but it is a real
  # password rather than an empty string on purpose: an empty one would produce
  # exactly the open server the chart refuses to start, and the run would fail
  # for the right reason at the wrong place.
  # TEMPORARY, REVERTED IN THIS PR: "requirepas" instead of "requirepass", the
  # typo that would otherwise start an open server that looks healthy. Expected:
  # the init container refuses, the pod never runs the server, and its log names
  # the field without printing it.
  auth-conf: requirepas ci-valkey-throwaway-password