# Wire Infisical as the backing store for ExternalSecrets. Replace host/tokenRef before sync.
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
  name: infisical
spec:
  provider:
    infisical:
      host: https://app.infisical.com
      auth:
        universalAuthCredentials:
          clientId:
            key: clientId
            namespace: platform-security
            name: infisical-universal-auth
          clientSecret:
            key: clientSecret
            namespace: platform-security
            name: infisical-universal-auth