{{- /*
ExternalSecret — Keycloak OIDC client secret for the SME-vcluster realm.

The `stalwart` confidential client is registered in the SME-vcluster
Keycloak realm at vcluster provisioning time (#804 — tenant provisioning
pipeline). The client secret is written to the operator's OpenBao at
the canonical path `sovereign/<sovereign-fqdn>/stalwart/<tenant>/oidc`
with property `OIDC_CLIENT_SECRET`. This ExternalSecret pulls it down
into the SME tenant namespace as the Secret named
`.Values.keycloak.clientSecretName`.

Operator overlay must supply `keycloak.oidcExternalSecret.remoteRef.key`
— EMPTY here so a misconfiguration fails fast at render. Capability-
gated on external-secrets.io/v1beta1 (issue #190).
*/ -}}
{{- $o := .Values.keycloak.oidcExternalSecret | default dict -}}
{{- $remote := $o.remoteRef | default dict -}}
{{- /*
Smoke-render-safe gate — same pattern as admin-externalsecret.yaml.
Operator overlay supplies remoteRef.key (canonical path
`sovereign/<sovereign-fqdn>/stalwart/<tenant>/oidc`).
*/ -}}
{{- if and $o.enabled $remote.key (.Capabilities.APIVersions.Has "external-secrets.io/v1beta1") -}}
{{- $store := $o.secretStoreRef | default dict -}}
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: {{ .Values.keycloak.clientSecretName | quote }}
  labels:
    {{- include "bp-stalwart-tenant.labels" . | nindent 4 }}
spec:
  refreshInterval: {{ $o.refreshInterval | default "1h" | quote }}
  secretStoreRef:
    kind: {{ $store.kind | default "ClusterSecretStore" | quote }}
    name: {{ $store.name | default "vault-region1" | quote }}
  target:
    name: {{ .Values.keycloak.clientSecretName | quote }}
    creationPolicy: Owner
  data:
    - secretKey: OIDC_CLIENT_SECRET
      remoteRef:
        key: {{ $remote.key | quote }}
        property: {{ $remote.property | default "OIDC_CLIENT_SECRET" | quote }}
{{- end }}
