Stéphane Tailland
eed8c3da3b
Every agent has to name this client in the audience scopes it requests, so the one thing an agent could not avoid naming was the very thing it should know nothing about. The gateway serving those URLs is replaceable; the contract should not imply otherwise. kong-token-exchange-broker becomes token-exchange-broker, same credential, same behaviour. The rename was rolled out in order — new client alongside the old, then the callers, then the gateways, then removal — so no call ever hit a realm that had forgotten the name its caller was still using. Followed through the client scope, the audience mappers, the fine-grained admin policy allow-broker-client, and the roles map. The Vault property keeps the old name. Renaming it there means re-issuing the value to every gateway holding a copy, for no gain; the ExternalSecret maps it to KC_SECRET_TOKEN_EXCHANGE_BROKER instead, so everything the cluster can see is neutral. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
# The client secrets and user passwords the realm file used to carry in clear.
|
|
# Keycloak resolves ${PLACEHOLDER} in a realm import file from the environment,
|
|
# so the file keeps the structure and this Secret supplies the values.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: keycloak-realm-secrets
|
|
namespace: keycloak
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-keycloak
|
|
target:
|
|
name: keycloak-realm-secrets
|
|
creationPolicy: Owner
|
|
dataFrom:
|
|
# Whole-path pull: adding a client in the realm means adding its secret in
|
|
# Vault, with no edit here.
|
|
- extract:
|
|
key: keycloak/classic-models-realm
|
|
data:
|
|
# The token-exchange broker was renamed to drop the middleware's name from
|
|
# a contract every agent has to repeat. The Vault property still carries the
|
|
# old name — renaming it there means re-issuing the value to every gateway
|
|
# that holds a copy — so it is mapped here instead. Same secret, neutral
|
|
# name everywhere the cluster can see.
|
|
- secretKey: KC_SECRET_TOKEN_EXCHANGE_BROKER
|
|
remoteRef:
|
|
key: keycloak/classic-models-realm
|
|
property: KC_SECRET_KONG_TOKEN_EXCHANGE_BROKER
|