{{- /*
The 1Password items this chart materializes. Two of them, because they have
different lifetimes rather than different audiences: the database credential
lives as long as the release, while the bootstrap administrator is meant to be
switched off again after the first install.

WHAT THE FIELD NAMES ARE AND WHY THEY ARE NOT FREE-FORM: the operator
materializes one Secret key per FIELD of the item, and the Deployment
references those keys by name. An item without the expected field leaves the
container in CreateContainerConfigError - not in a crash loop, and not with a
message about the field. NOTES.txt lists all four fields for the installer.

THEY ARRIVE AS ENVIRONMENT VARIABLES AND THAT IS FORCED, NOT PREFERRED.
Keycloak 26 has no _FILE indirection for an option's value: there is no
KC_DB_PASSWORD_FILE and no generic KC_<OPTION>_FILE. Checked against the 26.8.0
option table - every KC_*_FILE variable there is a PATH option (certificate,
key store, trust store, log file, export file), i.e. "point at this file", not
"read this option's value from a file". So the file form valkey argues for is
simply unavailable here. DO NOT "FIX" THIS to a file mount: there is no option
that would read it. (Keycloak's Vault SPI, KC_VAULT=file, is a different and
larger mechanism with its own naming scheme, and adopting it would be its own
decision.)

AND THE LIMIT THAT CANNOT BE CLOSED: a change to the CONTENT of either item
restarts nothing. Helm never sees a secret the 1Password operator
materializes, so there is nothing to hash. What this chart does cover is the
op:// PATH, through checksum/secret-ref on the pod template. After rotating a
value INSIDE an item the manual step is
  kubectl -n <ns> rollout restart deployment/<release>-keycloak-deployment

The 1Password operator's auto-restart annotation is NOT set here. Unlike the
StatefulSet charts in this repo it WOULD work - the operator enumerates
Deployments - so this is a decision rather than a constraint: its trigger is
the item's version COUNTER and not its content, so a re-save with identical
values rolls the whole cluster. For an identity provider, an unannounced
rolling restart because somebody opened a vault entry is worse than a
deliberate one. README guideline 9 has the precedence trap if it is ever set.
*/ -}}
{{- $settings := fromYaml (include "keycloak.settings" .) -}}
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-db-secret
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  # Must carry the fields: username, password
  #
  # The role needs to own its schema: Keycloak creates and migrates the whole
  # schema itself through Liquibase on first start, so a read-write grant on
  # existing tables is not enough.
  #
  # Host, port and database name are NOT in this item - they are plain values
  # (keycloak.db.host / .port / .database), because they are not secret and
  # because moving a database should not mean editing a vault entry.
  itemPath: {{ required "You must provide a database secret reference (secrets.databaseSecretRef) - the 1Password item holding the fields 'username' and 'password' of the PostgreSQL role Keycloak uses" .Values.secrets.databaseSecretRef }}
{{- if $settings.bootstrapAdmin.enabled }}
---
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-bootstrap-admin-secret
  labels:
    app: {{ .Release.Name }}-{{ .Chart.Name }}-deployment
spec:
  # Must carry the fields: username, password
  #
  # THIS ACCOUNT IS TEMPORARY, and that is a change from Keycloak before 26 -
  # the old KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD pair created a regular
  # administrator. Upstream on the current pair: "A user or service admin
  # account created using one of the methods described below is temporary ...
  # the account should exist only for the duration necessary to perform
  # operations needed to gain permanent and more secure admin access. After
  # that, the account needs to be removed manually."
  #
  # So creating a permanent administrator after the first install is a
  # MANDATORY step, and switching keycloak.bootstrapAdmin.enabled to false
  # afterwards removes both this item and the per-start log line about the
  # initial administrator not being created. NOTES.txt has the sequence.
  #
  # Upstream's default for the username is "temp-admin"; this chart takes both
  # fields from the vault so the pair has one source of truth.
  itemPath: {{ required "You must provide a bootstrap admin secret reference (secrets.bootstrapAdminSecretRef) - the 1Password item holding the fields 'username' and 'password' of the TEMPORARY bootstrap administrator. Required while keycloak.bootstrapAdmin.enabled is true; set that to false once a permanent administrator exists" .Values.secrets.bootstrapAdminSecretRef }}
{{- end }}