apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: keycloak-bootstrap-admin
spec:
  vaultAuthRef: vault-auth-auth-platform
  mount: secret
  type: kv-v2
  path: keycloak/bootstrap-admin
  refreshAfter: 60s
  destination:
    name: keycloak-bootstrap-admin
    create: true
    overwrite: true
    labels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/component: identity-provider
      app.kubernetes.io/managed-by: vault-secrets-operator
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: keycloak-bootstrap-admin-operator
spec:
  vaultAuthRef: vault-auth-auth-platform
  mount: secret
  type: kv-v2
  path: keycloak/bootstrap-admin
  refreshAfter: 60s
  destination:
    name: keycloak-bootstrap-admin-operator
    create: true
    overwrite: true
    labels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/component: identity-provider
      app.kubernetes.io/managed-by: vault-secrets-operator
    transformation:
      excludeRaw: true
      templates:
        username:
          text: '{{ .Secrets.KEYCLOAK_ADMIN }}'
        password:
          text: '{{ .Secrets.KEYCLOAK_ADMIN_PASSWORD }}'
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: keycloak-db-operator
spec:
  vaultAuthRef: vault-auth-auth-platform
  mount: secret
  type: kv-v2
  path: keycloak/db
  refreshAfter: 60s
  destination:
    name: keycloak-db-operator
    create: true
    overwrite: true
    labels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/component: database
      app.kubernetes.io/managed-by: vault-secrets-operator
    transformation:
      excludeRaw: true
      templates:
        username:
          text: keycloak
        password:
          text: '{{ .Secrets.password }}'
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: keycloak-client-auth-server-ingress
spec:
  vaultAuthRef: vault-auth-auth-platform
  mount: secret
  type: kv-v2
  path: keycloak/clients/auth-server-ingress
  refreshAfter: 60s
  destination:
    name: keycloak-client-auth-server-ingress
    create: true
    overwrite: true
    labels:
      app.kubernetes.io/name: keycloak
      app.kubernetes.io/component: identity-provider
      app.kubernetes.io/managed-by: vault-secrets-operator
    transformation:
      excludeRaw: true
      templates:
        client-secret:
          text: '{{ .Secrets.client_secret }}'