{{- if .Values.guacamole.enabled -}}
# SealedSecret placeholder for the Keycloak OIDC client secret.
#
# Per docs/INVIOLABLE-PRINCIPLES.md #5 the chart must NEVER carry the
# real secret value. This manifest declares a SealedSecret with an
# empty placeholder; the operator runs:
#
#   kubeseal --controller-namespace kube-system \
#     --controller-name sealed-secrets \
#     --raw --from-file=client-secret=/path/to/secret \
#     --namespace {{ .Release.Namespace }} \
#     --name {{ .Values.guacamole.oidc.clientSecretRef.name }}
#
# …pastes the resulting ciphertext into encryptedData.client-secret,
# and re-applies via Flux. The resulting Secret is consumed by
# guacamole-deployment.yaml's OPENID_CLIENT_SECRET env var.
#
# When the SealedSecret-controller's CRD is unavailable (test
# environments without bp-sealed-secrets), helm-template still
# succeeds — the manifest applies but Flux's reconciliation logs
# the missing CRD and the deployment will block on the absent
# Secret. That is the intended behaviour: bp-sealed-secrets is a
# hard dep of bp-guacamole.
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: {{ .Values.guacamole.oidc.clientSecretRef.name }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-guacamole.labels" . | nindent 4 }}
spec:
  encryptedData:
    # Empty placeholder — operator replaces via kubeseal.
    {{ .Values.guacamole.oidc.clientSecretRef.key }}: ""
  template:
    metadata:
      name: {{ .Values.guacamole.oidc.clientSecretRef.name }}
      namespace: {{ .Release.Namespace }}
      labels:
        {{- include "bp-guacamole.labels" . | nindent 8 }}
    type: Opaque
{{- end }}
