{{- if and .Values.existingSecret .Values.secret.GITLAB_PERSONAL_ACCESS_TOKEN }}
  {{- fail "Set EITHER existingSecret OR secret.GITLAB_PERSONAL_ACCESS_TOKEN, not both — the inline value would be silently ignored in favor of existingSecret." }}
{{- end }}
{{- if not .Values.existingSecret }}
{{- if and (eq .Values.config.AUTH_MODE "pat") (not .Values.secret.GITLAB_PERSONAL_ACCESS_TOKEN) }}
  {{- fail "secret.GITLAB_PERSONAL_ACCESS_TOKEN is required when AUTH_MODE=pat and no existingSecret is set." }}
{{- end }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "gitlab-mcp.fullname" . }}
  labels:
    {{- include "gitlab-mcp.labels" . | nindent 4 }}
type: Opaque
data:
  {{- range $key, $value := .Values.secret }}
  {{ $key }}: {{ $value | b64enc | quote }}
  {{- end }}
{{- end }}