{{- if not .Values.postgres.passwordVaultPath }}
# Legacy postgres-secret.yaml — chart-rendered Secret carrying
# POSTGRES_USER/PASSWORD/DB for the postgres StatefulSet. Used when
# `.Values.postgres.passwordVaultPath` is empty (the pre-ESO path).
# When that field is set, postgres-password-externalsecret.yaml
# renders an ExternalSecret producing the same Secret name + shape
# from OpenBao instead, and this template skips. Exactly one of the
# two ships per instance.
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "instance.fullname" . }}-pg
  labels:
    {{- include "instance.labels" . | nindent 4 }}
type: Opaque
stringData:
  POSTGRES_USER: {{ .Values.postgres.user | quote }}
  POSTGRES_PASSWORD: {{ include "instance.pgPassword" . | quote }}
  POSTGRES_DB: {{ .Values.postgres.database | quote }}
{{- end }}