# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the OIDC client secrets for the two confidential clients the realm import
# (keycloak-realm-import.yaml) provisions — grafana and oauth2-proxy. The realm import injects
# these values via spec.placeholders ($(env:GRAFANA_CLIENT_SECRET) / $(env:OAUTH2_PROXY_CLIENT_SECRET)),
# so the client secrets live ONLY here (SOPS-encrypted), never in the realm YAML (R-IDP-04; docs/07).
#
# HAND-OFF STEPS (operator):
#  (a) Generate two client secrets:
#         openssl rand -hex 32   # -> grafana-client-secret
#         openssl rand -hex 32   # -> oauth2-proxy-client-secret
#  (b) Copy to:      platform/keycloak/keycloak-realm-clients.sops.yaml
#  (c) Fill the two values below; encrypt:
#         sops -e -i platform/keycloak/keycloak-realm-clients.sops.yaml
#  (d) Add under `resources:` in platform/keycloak/kustomization.yaml:
#         - keycloak-realm-clients.sops.yaml
#  (e) THE SAME two values must also go into the CONSUMING apps' SOPS secrets so both sides match:
#        - oauth2-proxy-client-secret  -> platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
#                                          (key: client-secret)   [oauth2-proxy namespace]
#        - grafana-client-secret       -> platform/monitoring/grafana-oidc-credentials.sops.yaml
#                                          (key: client-secret)   [monitoring namespace]
#        - headlamp-client-secret      -> platform/headlamp/headlamp-oidc-credentials.sops.yaml
#                                          (key: clientSecret)     [headlamp namespace]
#      (Cross-namespace Secrets cannot be shared, hence one value stored in two encrypted files.)
#
# Until this file is filled + added to the kustomization, the KeycloakRealmImport stays PENDING
# (placeholder unresolved) — the documented bring-up gate for the SSO clients.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: keycloak-realm-clients
  namespace: keycloak
type: Opaque
stringData:
  grafana-client-secret: REPLACE-ME
  oauth2-proxy-client-secret: REPLACE-ME
  headlamp-client-secret: REPLACE-ME
  # Mirror into platform/crafty/crafty-oauth2-proxy-credentials.sops.yaml (key: client-secret).
  crafty-client-secret: REPLACE-ME