# The client secrets and user passwords the realm file used to carry in clear.
# Keycloak resolves ${PLACEHOLDER} in a realm import file from the environment,
# so the file keeps the structure and this Secret supplies the values.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycloak-realm-secrets
  namespace: keycloak
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-keycloak
  target:
    name: keycloak-realm-secrets
    creationPolicy: Owner
  dataFrom:
    # Whole-path pull: adding a client in the realm means adding its secret in
    # Vault, with no edit here.
    - extract:
        key: keycloak/classic-models-realm
  data:
    # The token-exchange broker was renamed to drop the middleware's name from
    # a contract every agent has to repeat. The Vault property still carries the
    # old name — renaming it there means re-issuing the value to every gateway
    # that holds a copy — so it is mapped here instead. Same secret, neutral
    # name everywhere the cluster can see.
    - secretKey: KC_SECRET_TOKEN_EXCHANGE_BROKER
      remoteRef:
        key: keycloak/classic-models-realm
        property: KC_SECRET_KONG_TOKEN_EXCHANGE_BROKER