# The agents' Keycloak client secrets, for the workflows that act as those
# agents. Read from the realm's own Vault entry rather than copied into n8n's
# path: there is one source for a client secret, and rotating it in Vault
# rotates it everywhere instead of leaving a stale twin behind.
#
# A narrow grant — this names the properties it wants, so the namespace receives
# those and nothing else of the realm.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: n8n-agent-secrets
  namespace: n8n
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-keycloak
  target:
    name: n8n-agent-secrets
  data:
    - secretKey: APPROVISIONNEMENT_CLIENT_SECRET
      remoteRef:
        key: keycloak/classic-models-realm
        property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT
    # Redeems a mandate. Held by the workflow rather than by the adapter because
    # it is the workflow that acts as the agent.
    - secretKey: MANDATE_CLIENT_SECRET
      remoteRef:
        key: keycloak/classic-models-realm
        property: KC_SECRET_MANDATE