{% for p in capi_providers %}
apiVersion: v1
kind: Namespace
metadata:
  name: {{ p.namespace }}
---
{% endfor %}
# Read by CAPMOX v0.9.1 components; the operator does not watch it, so rotating the token
# means a new Secret name + updated configSecret reference.
apiVersion: v1
kind: Secret
metadata:
  name: capmox-variables
  namespace: capmox-system
type: Opaque
# `data`, not `stringData`: stringData is never stored, so `kubectl apply` would report
# "configured" on every run and break the playbook's changed=0.
data:
  PROXMOX_URL: {{ proxmox_url | b64encode }}
  PROXMOX_TOKEN: {{ proxmox_token_id | b64encode }}
  PROXMOX_SECRET: {{ proxmox_token_secret | b64encode }}
{% for p in capi_providers %}
---
apiVersion: operator.cluster.x-k8s.io/v1alpha2
kind: {{ p.kind }}
metadata:
  name: {{ p.name }}
  namespace: {{ p.namespace }}
spec:
  version: {{ p.version }}
{% if p.config_secret is defined %}
  configSecret:
    name: {{ p.config_secret }}
{% endif %}
{% endfor %}