# The agents' Keycloak client secrets, for the workflows that act as those
# agents. Read from the realm's own Vault entry through the keycloak store, not
# copied into `n8n/*`: there is one source for a client secret, and rotating it
# in Vault rotates it everywhere rather than leaving a stale twin behind.
#
# It is a narrow grant — this ExternalSecret names the properties it wants, so
# the n8n namespace receives those and nothing else of the realm.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: n8n-agent-secrets
  namespace: n8n
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault-keycloak
  target:
    name: n8n-agent-secrets
  data:
    - secretKey: APPROVISIONNEMENT_CLIENT_SECRET
      remoteRef:
        key: keycloak/classic-models-realm
        property: KC_SECRET_CLASSIC_MODELS_AGENT_APPROVISIONNEMENT