38 lines
2.1 KiB
Plaintext
38 lines
2.1 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
|
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
|
#
|
|
# WHAT THIS IS: the OIDC client secrets for the two confidential clients the realm import
|
|
# (keycloak-realm-import.yaml) provisions — grafana and oauth2-proxy. The realm import injects
|
|
# these values via spec.placeholders ($(env:GRAFANA_CLIENT_SECRET) / $(env:OAUTH2_PROXY_CLIENT_SECRET)),
|
|
# so the client secrets live ONLY here (SOPS-encrypted), never in the realm YAML (R-IDP-04; docs/07).
|
|
#
|
|
# HAND-OFF STEPS (operator):
|
|
# (a) Generate two client secrets:
|
|
# openssl rand -hex 32 # -> grafana-client-secret
|
|
# openssl rand -hex 32 # -> oauth2-proxy-client-secret
|
|
# (b) Copy to: platform/keycloak/keycloak-realm-clients.sops.yaml
|
|
# (c) Fill the two values below; encrypt:
|
|
# sops -e -i platform/keycloak/keycloak-realm-clients.sops.yaml
|
|
# (d) Add under `resources:` in platform/keycloak/kustomization.yaml:
|
|
# - keycloak-realm-clients.sops.yaml
|
|
# (e) THE SAME two values must also go into the CONSUMING apps' SOPS secrets so both sides match:
|
|
# - oauth2-proxy-client-secret -> platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml
|
|
# (key: client-secret) [oauth2-proxy namespace]
|
|
# - grafana-client-secret -> platform/monitoring/grafana-oidc-credentials.sops.yaml
|
|
# (key: client-secret) [monitoring namespace]
|
|
# (Cross-namespace Secrets cannot be shared, hence one value stored in two encrypted files.)
|
|
#
|
|
# Until this file is filled + added to the kustomization, the KeycloakRealmImport stays PENDING
|
|
# (placeholder unresolved) — the documented bring-up gate for the SSO clients.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: keycloak-realm-clients
|
|
namespace: keycloak
|
|
type: Opaque
|
|
stringData:
|
|
grafana-client-secret: REPLACE-ME
|
|
oauth2-proxy-client-secret: REPLACE-ME
|