# Database "keycloak": password, role, database and read access for the app.
# To add another database copy this file and replace the name.

# Generated once; the role and the application both read this Secret.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycloak-db
  namespace: psql
spec:
  refreshPolicy: CreatedOnce
  target:
    name: keycloak-db
    template:
      type: kubernetes.io/basic-auth
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        username: keycloak
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: db-password
---
apiVersion: postgresql.cnpg.io/v1
kind: DatabaseRole
metadata:
  name: main-keycloak
  namespace: psql
spec:
  cluster:
    name: main
  name: keycloak
  login: true
  passwordSecret:
    name: keycloak-db
---
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: main-keycloak
  namespace: psql
spec:
  cluster:
    name: main
  name: keycloak
  owner: keycloak
  databaseReclaimPolicy: retain
---
# Lets the keycloak namespace read only its own credentials Secret.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: keycloak-db-reader
  namespace: psql
rules:
  - apiGroups: [""]
    resources: [secrets]
    resourceNames: [keycloak-db]
    verbs: [get, list, watch]
  - apiGroups: [authorization.k8s.io]
    resources: [selfsubjectrulesreviews]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: keycloak-db-reader
  namespace: psql
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: keycloak-db-reader
subjects:
  - kind: ServiceAccount
    name: db-credentials-reader
    namespace: keycloak