apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: passbolt-custom-fields-example
spec:
  refreshInterval: "1h0m0s"
  secretStoreRef:
    name: passbolt
    kind: SecretStore
  target:
    name: passbolt-custom-fields
  data:
    # Fetch a single custom field by its display name (metadata_key).
    # The property value is the literal prefix "custom_fields." followed by
    # the name of the field as configured in Passbolt.
  - secretKey: api_token
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4 # Replace with the ID of an existing Passbolt secret
      property: custom_fields.api-token
  - secretKey: deploy_key
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4
      property: custom_fields.deploy-key
    # Omitting property returns the full secret as JSON, with custom_fields
    # included as a nested object keyed by the field display name.
  - secretKey: full_secret
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4