{{- if eq "postgres" (lower .Values.secretBackend.type) }}
{{- if empty .Values.secretBackend.postgres.encryptionKeySecret }}
{{- $secretName := include "iceberg-catalog.fullname" . }}
{{- $secretName = printf "%s-postgres-encryption" $secretName }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  annotations:
    helm.sh/resource-policy: "keep"
  labels:
    app.kubernetes.io/component: config
type: Opaque
data:
  {{- $secretObj := (lookup "v1" "Secret" .Release.Namespace $secretName) | default dict }}
  {{- $secretData := (get $secretObj "data") | default dict }}
  {{- $encryptionKey := (get $secretData "encryptionKey") | default (randAlphaNum 40 | b64enc) }}
  encryptionKey: {{ $encryptionKey | quote }}
{{- end }}
{{- end }}