{{- $proxy := (index .Values "oauth2-proxy") | default dict -}}
{{- $config := $proxy.config | default dict -}}
{{- $ownSecret := printf "%s-%s-oauth2-proxy-secret" .Release.Name .Chart.Name -}}
{{- if and $proxy.enabled (eq (tpl ($config.existingSecret | default "") .) $ownSecret) }}
# The three credentials the proxy needs, as a 1Password item (README, guideline
# 8). This chart renders the CR itself rather than only expecting a Secret name,
# for the same reason every other chart here does: the operator is the repo's
# secret mechanism, and a chart that only names a Secret leaves the operator
# half of the wiring to a second, undocumented place.
#
# It is rendered only while the subchart still points at THIS name. Set
# oauth2-proxy.config.existingSecret to a Secret of your own and the chart
# creates nothing here - your Secret then has to carry the same three keys.
#
# Note what the operator does and does not do: it copies the item's FIELD NAMES
# into the Secret's keys. A field spelled differently produces a Secret without
# that key, the install stays green, and the proxy pod sits in
# CreateContainerConfigError. See values.yaml for the three names and for the
# URL-safe base64 trap on cookie-secret.
apiVersion: onepassword.com/v1
kind: OnePasswordItem
metadata:
  name: {{ $ownSecret }}
spec:
  itemPath: {{ required "The oauth2-proxy needs its credentials: set secrets.oauth2ProxySecretRef to the op:// path of an item carrying client-id, client-secret and cookie-secret - or point oauth2-proxy.config.existingSecret at a Secret you manage yourself." .Values.secrets.oauth2ProxySecretRef }}
{{- end }}