# Reads secrets/keycloak/* from Vault. A store of its own rather than reusing
# vault-kong-v2 or vault-observability: each carries a policy scoped to its own
# path, so a reader for one estate cannot see another's. Widening an existing
# policy would have handed Kong's reader every client secret in the realm.
#
# The AppRole credentials are NOT in git. Created once against Vault:
#   vault policy write keycloak-readonly  (read on secrets/{data,metadata}/keycloak/*)
#   vault write auth/approle/role/keycloak-eso token_policies=keycloak-readonly
#   vault read  auth/approle/role/keycloak-eso/role-id
#   vault write -f auth/approle/role/keycloak-eso/secret-id
#   kubectl -n external-secrets create secret generic vault-approle-keycloak \
#     --from-literal=roleId=<...> --from-literal=secretId=<...>
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: vault-keycloak
spec:
  provider:
    vault:
      server: https://vault.sttlab.eu
      path: secrets
      version: v2
      auth:
        appRole:
          path: approle
          roleRef:
            name: vault-approle-keycloak
            namespace: external-secrets
            key: roleId
          secretRef:
            name: vault-approle-keycloak
            namespace: external-secrets
            key: secretId