Update of classic models realm config

.gitignore

@@ -1,12 +1,2 @@
 .DS_Store
 *.tmp
-
-# Real secrets: only secret.example.yaml is versioned.
-# k8s/kustomization.yaml still references secret.yaml, so a fresh clone must
-# create it first — see README.
-k8s/secret.yaml
-
-# TLS material
-*.crt
-*.key
-*.pem

k8s/README.md

@@ -42,18 +42,6 @@ k8s/
 
 ## Déploiement
 
-`k8s/secret.yaml` n'est pas versionné : il porte les mots de passe réels (base
-PostgreSQL, admin Keycloak, secrets clients OIDC). Le créer une fois depuis le
-gabarit, puis renseigner chaque `<CHANGE_ME>` :
-
-```bash
-cp k8s/secret.example.yaml k8s/secret.yaml
-$EDITOR k8s/secret.yaml
-```
-
-`k8s/kustomization.yaml` le référence, donc le déploiement échoue tant qu'il
-est absent.
-
 ```bash
 kubectl apply -k k8s/
 ```

k8s/keycloak/deployment.yaml

@@ -19,13 +19,6 @@ spec:
         app.kubernetes.io/name: keycloak
         app.kubernetes.io/component: idp
         app.kubernetes.io/part-of: keycloak
-      annotations:
-        # Discovered by the Prometheus in the observability namespace.
-        # Endpoint exposed by KC_METRICS_ENABLED=true, on the management
-        # port (9000), never on the application port.
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "9000"
-        prometheus.io/path: "/metrics"
     spec:
       initContainers:
         - name: download-otel-agent
@@ -109,7 +102,7 @@ spec:
             - name: OTEL_SERVICE_NAME
               value: "keycloak"
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "http://tempo.observability.svc.cluster.local:4318"
+              value: "http://jaeger.observability.svc.cluster.local:4318"
             - name: OTEL_EXPORTER_OTLP_PROTOCOL
               value: "http/protobuf"
             - name: OTEL_TRACES_EXPORTER

k8s/secret.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: keycloak-secrets
+  namespace: keycloak
+type: Opaque
+stringData:
+  POSTGRES_USER: keycloak
+  POSTGRES_PASSWORD: keycloak-db-pass-2026
+  POSTGRES_DB: keycloak
+  KC_DB_USERNAME: keycloak
+  KC_DB_PASSWORD: keycloak-db-pass-2026
+  KC_BOOTSTRAP_ADMIN_USERNAME: admin
+  KC_BOOTSTRAP_ADMIN_PASSWORD: mermAid-giganTic-s3ea
+  KEYCLOAK_ADMIN: admin
+  KEYCLOAK_ADMIN_PASSWORD: mermAid-giganTic-s3ea
+  LIBRECHAT_OIDC_SECRET: librechat-oidc-secret-2026
+  CLIENT_SECRET: classic-models-client-secret-2026
+  USER_PASSWORD: Password123@