apiVersion: secrets.infisical.com/v1beta1
kind: InfisicalAuth
metadata:
  name: infisical-auth
  namespace: infisical-operator
spec:
  infisicalConnectionRef:
    name: infisical-connection
    namespace: infisical-operator
  method: kubernetes
  kubernetes:
    identityIdRef:
      name: infisical-machine-identity
      namespace: infisical-operator
      key: identityId
    serviceAccountRef:
      name: infisical-opera-controller-manager   # operator's own SA = the allow-listed identity
      namespace: infisical-operator