Stéphane Tailland
023a89bf71
catalog-agent was one rename too aggressive: 'catalogue' is accepted, and the Keycloak client, its audience scope and the Vault key that names it were never renamed to match — leaving an inconsistency between what Kubernetes and Keycloak call the same agent. Keycloak carries more weight to move, so this side moves back. k8s/namespace.yaml is out of this Kustomization's inventory. It was in 2026-08-31 when renaming the Kustomization pruned the old one — which owned the namespace three agents share — and took all three down. A namespace shared across repos should not be owned by any one of them. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
25 lines
881 B
YAML
25 lines
881 B
YAML
# The agent's Keycloak client secret, and nothing else. It comes from the same
|
|
# Vault entry the realm import reads, so there is exactly one copy of this
|
|
# secret in the estate and rotating it in Vault rotates it everywhere.
|
|
#
|
|
# vault-keycloak rather than a store of the agents' own: this value is a
|
|
# Keycloak client secret, owned by the realm, and inventing a second AppRole to
|
|
# read the same path would add a credential without adding a boundary.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: catalogue-agent-secrets
|
|
namespace: agents
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: catalogue-agent-secrets
|
|
data:
|
|
- secretKey: CATALOGUE_CLIENT_SECRET
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_CLASSIC_MODELS_AGENT_CATALOGUE
|