{{- if .Values.elasticsearch.enabled }}
{{- if not .Values.elasticsearch.fluentbitPassword }}
{{- fail "elasticsearch.fluentbitPassword is required when elasticsearch.enabled=true — no hardcoded default is shipped" }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: elasticsearch-credentials
  namespace: {{ include "cloudhost-app.namespace" . }}
  labels:
    {{- include "cloudhost-app.labels" . | nindent 4 }}
type: Opaque
stringData:
  ELASTIC_PASSWORD: {{ .Values.elasticsearch.elasticPassword | quote }}
  FLUENTBIT_PASSWORD: {{ .Values.elasticsearch.fluentbitPassword | quote }}
  KIBANA_SYSTEM_PASSWORD: {{ .Values.elasticsearch.kibanaPassword | quote }}
{{- end }}