# yaml-language-server: $schema=../../api/jsonschema/harp.bundle.v1/Patch.json
apiVersion: harp.elastic.co/v1
kind: BundlePatch
meta:
  name: "service-account-rotator"
  owner: cluster-admin@elastic.co
  description: "Rotate cluster service account password"
spec:
  rules:
  # Rule targets production and staging path
  - selector:
      matchPath:
        regex: "app/(production|staging)/observability/deployer/1.0.0/clusters/.*/.*/[0-9a-z]{32}/users"
    package:
      # Patch concerns secret data
      data:
        # We want to update a K/V couple
        kv:
          # Update entry if exists
          update:
            "{{ .Values.serviceAccountName }}": "{{ noSymbolPassword }}"
