@startuml
node Vault as vault
cloud "Kubernetes Cluster"#LightBlue {
    node operator-ns {
    node pod {
        component SecretsOperator as operator
    }
    }
    operator <-> vault
    node ns1 {
        file secret as pki1
        node pod as pod1 {
            component app as app1
        }
        app1 --> pki1 : read
    }
    node ns2 {
        file secret as secret2
        node pod as pod2 {
            component app as app2
        }
        app2 --> secret2 : read
    }
    node ns3 {
        file secret as secret3
        node pod as pod3 {
            component app as app3
        }
        app3 --> secret3 : read
    }
    operator ---> pki1 : sync
    operator ---> secret2 : sync
    operator ---> secret3 : sync

}
@enduml

@startuml
title Deployment with Vault in Kubernetes
cloud "Kubernetes Cluster"#LightBlue {
    node vault-ns {
        node Vault as vault
    }
    node operator-ns {
        node SecretsOperator as operator
    }
    operator <-> vault
    node ns1 {
        file "static-secret" as pki1
        node pod as pod1 {
            component app as app1
        }
        app1 --> pki1 : read
    }
    node ns2 {
        file "dynamic-secret" as secret2
        node pod as pod2 {
            component app as app2
        }
        app2 --> secret2 : read
    }
    node ns3 {
        file "pki-secret" as secret3
        node pod as pod3 {
            component app as app3
        }
        app3 --> secret3 : read
    }
    operator ---> pki1 : sync
    operator ---> secret2 : sync
    operator ---> secret3 : sync

}
caption deployment figure 1
@enduml

@startuml
title Deployment Detailed
cloud "Kubernetes Cluster"#LightBlue {
    node vault-ns {
        node Vault as vault
    }
    node operator-ns {
        folder CRs as crs1 {
            file "VaultAuth" as auth
            file "VaultConnection" as conn
        }
        node SecretsOperator as operator
    }

    operator -[dashed]-> crs1 : read
    operator -[dotted]0 vault

    node tenant-ns {
        node "serviceAccount/default" as sa
        folder CRs {
            file "VaultPKISecret"
            file "VaultStaticSecret"
        }
        folder "K8S Secrets" {
            file "pki1" as pki1
            file "secret1" as secret1
        }
        node pod as pod1 {
            component app1
        }
        app1 --> pki1 : mount /etc/pki
        app1 --> secret1 : mount /etc/secrets
    }
    operator -[dashed]-> CRs : read
    operator -[dotted]-> pki1 : sync
    operator -[dotted]-> secret1 : sync
    operator -[dotted]-> sa : provides token for vault auth
}
caption deployment figure 2
@enduml

@startuml
autonumber
title CD Pipeline Example
skinparam {
    BackgroundColor LightBlue
    sequenceMessageAlign left
}

actor "Alice" as deployer
participant "CD Agent: ArgoCD/Flux" as cd
participant "Kubernetes Scheduler" as k8s
collections "GitOps Repo" as repo

deployer -> repo : Push Secrets Operator Helm Chart resource
cd <- repo : Helm install the Secrets Operator
k8s -> k8s : Brings up the Secrets Operator Pod
deployer -> repo : Push Secrets CRs and Application spec
cd <- repo : Apply Secret CRs and Application spec
k8s -> k8s : Brings up the Application Pod and its Secrets
caption deployment figure 3
@enduml
