refactor: generalize chart by removing ZTVP-specific defaults

Chart.yaml

@@ -4,7 +4,7 @@ keywords:
   - pattern
 name: rhbk
 type: application
-version: 0.0.12
+version: 0.1.0
 home: https://github.com/validatedpatterns/rhbk-chart
 maintainers:
   - name: Validated Patterns Team

templates/_helpers.tpl

@@ -35,4 +35,22 @@ Generate the target lifecycle for the ExternalSecrets resource.
 {{- define "keycloak.externalSecrets.targetLifecycle" -}}
 creationPolicy: {{ .local.creationPolicy | default .global.creationPolicy }}
 deletionPolicy: {{ .local.deletionPolicy | default .global.deletionPolicy }}
+{{- end }}
+
+{{/*
+Generate the lifecycle for an extraSecrets entry.
+Per-entry fields override global defaults.
+*/}}
+{{- define "keycloak.extraSecrets.lifecycle" -}}
+refreshPolicy: {{ .local.refreshPolicy | default .global.refreshPolicy }}
+refreshInterval: {{ .local.refreshInterval | default .global.refreshInterval }}
+{{- end }}
+
+{{/*
+Generate the target lifecycle for an extraSecrets entry.
+Per-entry fields override global defaults.
+*/}}
+{{- define "keycloak.extraSecrets.targetLifecycle" -}}
+creationPolicy: {{ .local.creationPolicy | default .global.creationPolicy }}
+deletionPolicy: {{ .local.deletionPolicy | default .global.deletionPolicy }}
 {{- end }}

templates/extra-secrets.yaml

@@ -0,0 +1,36 @@
+{{- range .Values.keycloak.extraSecrets }}
+---
+apiVersion: "external-secrets.io/v1"
+kind: ExternalSecret
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Release.Namespace }}
+  {{- with .metadata }}
+  {{- toYaml . | nindent 2 }}
+  {{- end }}
+spec:
+  {{ include "keycloak.extraSecrets.lifecycle" (dict "local" . "global" $.Values.global) | nindent 2 }}
+  secretStoreRef:
+    name: {{ $.Values.global.secretStore.name }}
+    kind: {{ $.Values.global.secretStore.kind }}
+  target:
+    name: {{ .targetName | default .name }}
+    {{ include "keycloak.extraSecrets.targetLifecycle" (dict "local" . "global" $.Values.global) | nindent 4 }}
+    template:
+      {{- with .targetMetadata }}
+      metadata:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      type: Opaque
+      data:
+        {{- range $key, $val := .templateData }}
+        {{ $key }}: {{ $val | quote }}
+        {{- end }}
+  data:
+  {{- range .data }}
+  - secretKey: {{ .secretKey }}
+    remoteRef:
+      key: {{ .remoteRef.key }}
+      property: {{ .remoteRef.property }}
+  {{- end }}
+{{- end }}

templates/keycloak-realm-import.yaml

@@ -1,12 +1,5 @@
-{{- if or .Values.keycloak.defaultConfig .Values.keycloak.realms }}
-{{/*
-Merge realms
-*/}}
-{{- $realms := .Values.keycloak.realms | default list }}
-{{- if .Values.keycloak.defaultConfig }}
-{{- $realms = append $realms .Values.keycloak.defaultRealm }}
-{{- end }}
-{{- range $realms }}
+{{- if .Values.keycloak.realms }}
+{{- range .Values.keycloak.realms }}
 {{- $realm := deepCopy . }}
 {{- $localDomain := $.Values.global.localClusterDomain }}
 {{- $oidcProviderBase := printf "https://spire-spiffe-oidc-discovery-provider.%s" $localDomain }}
@@ -51,40 +44,9 @@ spec:
   keycloakCRName: keycloak
   realm:
 {{- toYaml $realm | nindent 4 }}
+{{- with $.Values.keycloak.realmPlaceholders }}
   placeholders:
-    QTODO_ADMIN_PASSWORD:
-      secret:
-        name: {{ $.Values.keycloak.users.secretName }}
-        key: qtodo-admin-password
-    QTODO_USER1_PASSWORD:
-      secret:
-        name: {{ $.Values.keycloak.users.secretName }}
-        key: qtodo-user1-password
-    RHTAS_USER_PASSWORD:
-      secret:
-        name: {{ $.Values.keycloak.users.secretName }}
-        key: rhtas-user-password
-    RHTPA_USER_PASSWORD:
-      secret:
-        name: {{ $.Values.keycloak.users.secretName }}
-        key: rhtpa-user-password
-{{- if and $.Values.keycloak.oidcSecrets.qtodo (default false $.Values.keycloak.oidcSecrets.qtodo.enabled) }}
-    QTODO_CLIENT_SECRET:
-      secret:
-        name: oidc-client-secret
-        key: client-secret
+    {{- toYaml . | nindent 4 }}
 {{- end }}
-    RHTPA_CLI_SECRET:
-      secret:
-        name: rhtpa-oidc-cli-secret
-        key: client-secret
-    ACS_ADMIN_PASSWORD:
-      secret:
-        name: {{ $.Values.keycloak.users.secretName }}
-        key: acs-admin-password
-    ACS_CLIENT_SECRET:
-      secret:
-        name: acs-oidc-client-secret
-        key: client-secret
 {{- end }}
 {{- end }}