{{- if .Values.global.enableSecretManagement | default true }}
{{- /* Generic Secrets from .Values.secrets (each key is a secret definition) */ -}}
{{- range $name, $cfg := .Values.secrets }}
{{- if and (hasKey $cfg "name") (hasKey $cfg "data") }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $cfg.name }}
  {{- with $.Values.global.namespace }}
  namespace: {{ . }}
  {{- end }}
  labels:
    managed-by: unified
type: {{ $cfg.type | default "Opaque" }}
data:
  {{- range $k, $v := $cfg.data }}
  {{ $k }}: {{ $v | toString | b64enc }}
  {{- end }}
---
{{- end }}
{{- end }}
{{- end }}