# The client secrets and user passwords the realm file used to carry in clear.
# Keycloak resolves ${PLACEHOLDER} in a realm import file from the environment,
# so the file keeps the structure and this Secret supplies the values.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: keycloak-realm-secrets
  namespace: keycloak
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-keycloak
  target:
    name: keycloak-realm-secrets
    creationPolicy: Owner
  dataFrom:
    # Whole-path pull: adding a client in the realm means adding its secret in
    # Vault, with no edit here.
    - extract:
        key: keycloak/classic-models-realm