# SSH MCP Key Secret — MCP Phase 2a (ADR-071)
# ============================================
# 此 Secret 供 SSH MCP Provider 使用，讓 API Pod 可 SSH 到 188/110/111 主機執行診斷和修復指令。
#
# 建立步驟:
#   1. 在 API Pod 宿主機生成 SSH key pair:
#      ssh-keygen -t ed25519 -f /tmp/ssh-mcp-key -N "" -C "awoooi-mcp@k3s"
#
#   2. 將公鑰加入允許主機的 authorized_keys:
#      ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.188
#      ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.110
#      ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.111
#
#   3. 建立 K8s Secret:
#      kubectl create secret generic ssh-mcp-key \
#        --from-file=ssh_mcp_key=/tmp/ssh-mcp-key \
#        -n awoooi-prod
#
#   4. 刪除暫存 key:
#      rm /tmp/ssh-mcp-key /tmp/ssh-mcp-key.pub
#
#   5. 在 K8s Deployment 加入 volume mount (參考 apps/api/k8s-deployment.yaml)
#      volumeMounts:
#        - name: ssh-mcp-key
#          mountPath: /run/secrets/ssh_mcp_key
#          subPath: ssh_mcp_key
#          readOnly: true
#      volumes:
#        - name: ssh-mcp-key
#          secret:
#            secretName: ssh-mcp-key
#            defaultMode: 0400
#
#   6. 設定環境變數 SSH_MCP_ENABLED=true（在 K8s ConfigMap 或 Deployment env 加入）
#
# ⚠️ 此檔案是範本，實際 Secret 由 CI/CD 注入，禁止提交私鑰到 Git
# ⚠️ 04-ssh-mcp-secret.yaml 已加入 .gitignore

apiVersion: v1
kind: Secret
metadata:
  name: ssh-mcp-key
  namespace: awoooi-prod
  annotations:
    # MCP Phase 2a (ADR-071, 2026-04-11)
    description: "SSH private key for MCP SSH Provider — allows API pods to diagnose/repair host-layer services"
type: Opaque
data:
  # Base64 encoded private key
  # 使用方式: echo "$(cat /tmp/ssh-mcp-key | base64 -w 0)"
  ssh_mcp_key: "CHANGE_ME_BASE64_ENCODED_PRIVATE_KEY"
