# =============================================================================
# TEMPLATE, NOT APPLIED, NOT ENCRYPTED. The OIDC client and cookie secrets for the per-pod oauth2-proxy
# sidecar gating the CVE page (deployment.yaml, container oauth2-proxy). The sidecar reads these three
# keys by name only (R-IDP-04).
#
# The `client-secret` value MUST equal `vuln-scanner-client-secret` in
# platform/keycloak/keycloak-realm-clients.sops.yaml (a cross-namespace mirror, like crafty). See
# platform/vuln-scanner/README.md, "Operator step". Never decrypt this to a terminal or a log.
#
# Regenerate (encrypts to the repo's public recipient via .sops.yaml, values never echoed):
#   ./infra/devcontainer/dev.sh run bash -c '
#     cs=$(python3 -c "import secrets; print(secrets.token_hex(32))")
#     ck=$(python3 -c "import base64,os; print(base64.urlsafe_b64encode(os.urandom(32)).decode())")
#     sops -e --input-type yaml --output-type yaml \
#       --filename-override platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml \
#       /dev/stdin <<YAML > platform/vuln-scanner/vuln-scanner-oauth2-proxy-credentials.sops.yaml
#   ...this document with client-secret: $cs and cookie-secret: $ck...
#   YAML'
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: vuln-scanner-oauth2-proxy
  namespace: vuln-scanner
type: Opaque
stringData:
  client-id: vuln-scanner
  client-secret: REPLACE-ME
  cookie-secret: REPLACE-ME