{{- /*
Keycloak OIDC client-secret Secret for NewAPI's ops-staff admin UI
(t20 debug matrix Fix #6).

ROOT CAUSE
──────────
The bootstrap-kit overlay `clusters/_template/bootstrap-kit/80-newapi.yaml`
sets `auth.adminUI.keycloak.existingSecret: newapi-oidc` (line 171). The
deployment template (templates/deployment.yaml) gates Pod render on
`$kcConfigured = $kcMode && issuer && existingSecret`; when the gate is
met it wires:

    - name: OIDC_CLIENT_SECRET
      valueFrom:
        secretKeyRef:
          name: {{ .Values.auth.adminUI.keycloak.existingSecret }}
          key: OIDC_CLIENT_SECRET

Pre-this-fix, NOTHING in the chart NOR in the operator overlay populated
the `newapi-oidc` Secret on a freshly franchised Sovereign. Keycloak's
`configmap-sovereign-realm.yaml` declares `kubectl`, `catalyst-ui`, and
`catalyst-api-server` clients only — there is no `newapi-admin` client
in the realm import, so even a downstream `keycloak-config-cli` Job
would not produce a Secret on the newapi side. The Pod stayed in
`CreateContainerConfigError: secret "newapi-oidc" not found`, blocking
the entire bp-newapi HR from reaching Ready and gating slot-80 of
bootstrap-kit.

FIX PATTERN (matches the existing seam in this chart)
─────────────────────────────────────────────────────
Lookup-or-generate via Helm `lookup`, mirroring the canonical pattern
already used twice in this chart:

  - templates/credentials-secret.yaml          (issue #943)
  - templates/sandbox-token-signing-key-secret.yaml (PR #1638)

…and ultimately the load-bearing seam in platform/gitea/chart/templates/
admin-secret.yaml (issue #830 Bug 2 + feedback_passwords.md). The chart
emits a Secret named `.Values.auth.adminUI.keycloak.existingSecret`
(default: `newapi-oidc`) with key `OIDC_CLIENT_SECRET` carrying a
32-char alphanumeric value. On every reconcile `lookup` retrieves the
existing Secret and re-emits the same bytes — no rotation, no drift.
On first install `lookup` returns nothing and `randAlphaNum 32`
generates fresh bytes.

The sister chart platform/guacamole/chart/templates/keycloak-client-
secret.yaml uses a SealedSecret placeholder + an oidc-secret-bootstrap-
job.yaml hook Job that POSTs to the apiserver via curl. THIS chart
already standardised on the simpler `randAlphaNum + Helm lookup` pattern
for credentials-secret.yaml and sandbox-token-signing-key-secret.yaml,
so this Secret follows the same seam (one chart, one credential-
materialisation pattern — easier to audit and rotate).

KEYCLOAK SIDE
─────────────
This template only ensures the `newapi-oidc` Secret EXISTS so the Pod
clears `CreateContainerConfigError` and the bp-newapi HR can reach
Ready. The matching client-side wiring at Keycloak (declaring a
`newapi-admin` client with `clientSecret = $OIDC_CLIENT_SECRET` in the
sovereign realm import) is a separate concern handled by the
bp-keycloak chart's realm-config ConfigMap; without that wiring the
OIDC login flow fails at the IdP, but the Pod runs and the rest of
the chart's resources (Service, Ingress, ConfigMap, channel-seed Job)
reconcile normally.

Operator overrides — when the operator pre-creates a `newapi-oidc`
Secret manually (e.g. via a sealed-secret pipeline or external secret
store), this template's `lookup` finds it and re-emits the same bytes
(idempotent). If the operator wants a different Secret name entirely,
set `.Values.auth.adminUI.keycloak.existingSecret` to the alternate
name; the deployment.yaml reads from THAT name and this template
materialises THAT name (since the Secret is named after the value).

GATING
──────
Only renders when:
  1. `.Values.auth.adminUI.mode == "keycloak"` (the OIDC code path
     is active in NewAPI), AND
  2. `.Values.auth.adminUI.keycloak.existingSecret` is non-empty
     (the deployment.yaml's `$kcConfigured` gate references this name)

When either is empty the chart is in a non-keycloak mode (masterKey
bootstrap or no admin UI auth) and the Secret is not needed.

helm.sh/resource-policy: keep so a `helm uninstall` + reinstall
recovers the same bytes (otherwise an upgrade silently rotates the
OIDC client secret and the IdP-side wiring drifts).
*/}}
{{- $kcMode := eq .Values.auth.adminUI.mode "keycloak" -}}
{{- $secretName := .Values.auth.adminUI.keycloak.existingSecret -}}
{{- if and $kcMode $secretName -}}
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName -}}
{{- $clientSecret := "" -}}
{{- if and $existing $existing.data (index $existing.data "OIDC_CLIENT_SECRET") -}}
  {{- $clientSecret = index $existing.data "OIDC_CLIENT_SECRET" | b64dec -}}
{{- else -}}
  {{- $clientSecret = randAlphaNum 32 -}}
{{- end -}}
apiVersion: v1
kind: Secret
metadata:
  name: {{ $secretName }}
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
  annotations:
    helm.sh/resource-policy: keep
    catalyst.openova.io/comment: |
      NewAPI OIDC client-secret for the ops-staff admin UI (t20 Fix #6).
      First install: lookup returns nothing → randAlphaNum 32 →
      Secret materialises so the Pod clears
      `CreateContainerConfigError: secret "newapi-oidc" not found`.
      Subsequent reconciles: lookup returns the existing Secret →
      re-emits the same bytes → no rotation, no drift.
type: Opaque
data:
  OIDC_CLIENT_SECRET: {{ $clientSecret | b64enc | quote }}
{{- end }}
