# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/keycloak/keycloak-admin-credentials.sops.yaml
# (b) kustomization: add this line under `resources:` in
#                    platform/keycloak/kustomization.yaml
#                       - keycloak-admin-credentials.sops.yaml
# (c) Encrypt:       sops -e -i platform/keycloak/keycloak-admin-credentials.sops.yaml
# (d) Consumed by:   Keycloak Helm chart -> auth.existingSecret. [Phase 6]
#
# !! VERIFY KEY NAMES BEFORE ENCRYPTING !!
# The exact stringData key names depend on the pinned Keycloak chart version.
# Bitnami Keycloak commonly reads `admin-password`; some versions also read
# `admin-user` (and older/other variants use `adminPassword`). Check the pinned
# chart's values (auth.existingSecret / auth.passwordSecretKey) and adjust the
# keys below to match before running `sops -e -i`.
#
# !! SEPARATE DB SECRET LIKELY NEEDED !!
# The Keycloak helmrelease references "Admin + DB credentials". Keycloak needs a
# PostgreSQL DB credential in addition to these admin creds. A separate DB secret
# (or the chart's postgresql.auth.existingSecret) will likely be required at
# Phase 6 — flag and provision it then.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: keycloak-admin-credentials
  namespace: keycloak
type: Opaque
stringData:
  admin-user: admin
  admin-password: REPLACE-ME