# Example: rotate a service user's machine key with no gap.
#
# Machine keys overlap in ZITADEL, so the old key stays valid until the new one has
# obtained a token. Nothing in the window fails.
#
# Apply only after the controller runs and the machine user exists.
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: example-machine-key
  namespace: iam
spec:
  provider: zitadel-machine-key
  strategy: overlap
  intervalHours: 720        # 30 days
  suspend: true             # flip to false once the pilot is proven
  target:
    machineUserID: "REPLACE_WITH_SERVICE_USER_ID"
    secretName: example-jwt
    secretNamespace: iam
    secretKeys:
      key: key
      key-id: key-id
    reload: hot             # the consumer watches the file, so no restart
    consumers: []
  verify:
    tokenExchange: true
    audienceProject: "396757796898471937"