# Read-only access to the keycloak-db Secret in the psql namespace
# (see postgresql/databases/keycloak.yaml for the other half).
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: psql-credentials
spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycloak-creds
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
  target:
    name: keycloak-creds
    template:
      data:
        KC_DB_USERNAME: "{{ .username }}"
        KC_DB_PASSWORD: "{{ .password }}"
  data:
    - secretKey: username
      remoteRef:
        key: keycloak-db
        property: username
    - secretKey: password
      remoteRef:
        key: keycloak-db
        property: password
---
# Bootstrap admin: only used when the database has no admin user yet (a fresh
# install). With the restored database the existing admin accounts are kept.
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: keycloak-bootstrap
spec:
  length: 40
  digits: 10
  symbols: 0
  noUpper: false
  allowRepeat: true
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycloak-bootstrap
spec:
  refreshPolicy: CreatedOnce
  target:
    name: keycloak-bootstrap
    template:
      data:
        KC_BOOTSTRAP_ADMIN_USERNAME: admin
        KC_BOOTSTRAP_ADMIN_PASSWORD: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: keycloak-bootstrap