Skip to content

Lifecycle management for ExternalSecrets #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sabre1041 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Lifecycle management for ExternalSecrets #16

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ keywords:
- pattern
name: rhbk
type: application
version: 0.0.10
version: 0.0.11
home: https://github.com/validatedpatterns/rhbk-chart
maintainers:
- name: Validated Patterns Team
Expand Down
786 changes: 393 additions & 393 deletions README.md
View file
Open in desktop

Large diffs are not rendered by default.

28 changes: 27 additions & 1 deletion templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,4 +19,30 @@ Generate the hostname for the Ingress.
{{- else }}
{{- print .Values.keycloak.ingress.hostname }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Generate the metadata for the ExternalSecrets resource.
*/}}
{{- define "keycloak.externalSecrets.metadata" -}}
{{- if or .annotations .labels }}
metadata:
{{- if .annotations }}
annotations:
{{- toYaml .annotations | nindent 4 }}
{{- end }}
{{- if .labels }}
labels:
{{- toYaml .labels | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}

{{/*
Generate the lifecycle for the ExternalSecrets resource.
*/}}
{{- define "keycloak.externalSecrets.lifecycle" -}}
creationPolicy: {{ .creationPolicy }}
deletionPolicy: {{ .deletionPolicy }}
refreshPolicy: {{ .refreshPolicy }}
{{- end }}
2 changes: 2 additions & 0 deletions templates/acs-oidc-client-secret-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ spec:
kind: {{ .Values.global.secretStore.kind }}
target:
name: acs-oidc-client-secret
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.acs | nindent 4 }}
template:
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.acs | nindent 6 }}
type: Opaque
data:
client-secret: "{{ `{{ .client_secret }}` }}"
Expand Down
2 changes: 2 additions & 0 deletions templates/keycloak-admin-user-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ spec:
kind: {{ .Values.global.secretStore.kind }}
target:
name: {{ .Values.keycloak.adminUser.secretName }}
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.adminUser | nindent 4 }}
template:
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.adminUser | nindent 6 }}
type: Opaque
data:
username: "{{ .Values.keycloak.adminUser.username }}"
Expand Down
18 changes: 2 additions & 16 deletions templates/keycloak-users-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,30 +4,16 @@ kind: ExternalSecret
metadata:
name: keycloak-users
namespace: {{ .Release.Namespace }}
{{- if .Values.externalSecrets.oneShot }}
annotations:
argocd.argoproj.io/hook: Sync
argocd.argoproj.io/hook-delete-policy: HookSucceeded
argocd.argoproj.io/sync-options: PrunePropagationPolicy=orphan
{{- end }}
spec:
refreshInterval: 15s
secretStoreRef:
name: {{ .Values.global.secretStore.name }}
kind: {{ .Values.global.secretStore.kind }}
target:
name: keycloak-users
{{- if .Values.externalSecrets.oneShot }}
creationPolicy: Orphan
{{- else }}
creationPolicy: {{ .Values.externalSecrets.creationPolicy }}
{{- end }}
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.keycloakUsers | nindent 4 }}
template:
{{- if .Values.externalSecrets.oneShot }}
metadata:
labels:
{{ .Values.externalSecrets.secretCleanupLabel }}: delete
{{- end }}
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.keycloakUsers | nindent 6 }}
type: Opaque
data:
qtodo-admin-password: "{{ `{{ .qtodo_admin_password }}` }}"
Expand Down
2 changes: 2 additions & 0 deletions templates/oidc-client-secret-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ spec:
kind: {{ .Values.global.secretStore.kind }}
target:
name: oidc-client-secret
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.oidcClientSecret | nindent 4 }}
template:
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.oidcClientSecret | nindent 6 }}
type: Opaque
data:
client-secret: "{{ `{{ .client_secret }}` }}"
Expand Down
2 changes: 2 additions & 0 deletions templates/postgresql-db-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,9 @@ spec:
kind: {{ .Values.global.secretStore.kind }}
target:
name: {{ .Values.keycloak.postgresqlDb.secretName }}
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.postgresqlDb | nindent 4 }}
template:
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.postgresqlDb | nindent 6 }}
type: Opaque
data:
username: {{ .Values.keycloak.postgresqlDb.username }}
Expand Down
2 changes: 2 additions & 0 deletions templates/rhtpa-oidc-cli-secret-external-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,9 @@ spec:
kind: {{ .Values.global.secretStore.kind }}
target:
name: rhtpa-oidc-cli-secret
{{- include "keycloak.externalSecrets.lifecycle" .Values.externalSecrets.rhtpa | nindent 4 }}
template:
{{- include "keycloak.externalSecrets.metadata" .Values.externalSecrets.rhtpa | nindent 6 }}
type: Opaque
data:
client-secret: "{{ `{{ .client_secret | trim }}` }}"
Expand Down
53 changes: 37 additions & 16 deletions values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,23 +4,44 @@ global:
kind: ClusterSecretStore
name: vault-backend

# -- One-shot ExternalSecret provisioning for keycloak-users.
# When oneShot is true, the keycloak-users ExternalSecret becomes an
# ArgoCD Sync hook with HookSucceeded and creationPolicy: Orphan.
# Orphan prevents ESO from setting an ownerReference on the Secret,
# so k8s GC will not cascade-delete the Secret when ArgoCD removes
# the ExternalSecret hook after sync.
# A PostSync Job in the wrapper chart (e.g. rh-keycloak in
# layered-zero-trust) then cleans up Secrets labeled
# secretCleanupLabel=delete.
# When oneShot is false (default), keycloak-users is a regular
# ExternalSecret with no hook annotations — the Secret and
# ExternalSecret persist.
# @default -- disabled (regular ExternalSecret, no hooks)
# -- Properties associated with ExternalSecret resources.
externalSecrets:
oneShot: false
creationPolicy: Owner
secretCleanupLabel: "validatedpatterns.io/cleanup"
acs:
creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
annotations: {}
labels: {}
adminUser:
Copy link
Copy Markdown
Contributor

@minmzzhang minmzzhang May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is it keycloak admin user? is it possible to add comments here referencing back to the templates?

creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
Copy link
Copy Markdown
Contributor

@minmzzhang minmzzhang May 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since we specified the refreshPolicy as Periodic, do we want to add the refreshInterval as configurable?

Copy link
Copy Markdown
Contributor Author

@sabre1041 sabre1041 May 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add that in a subsequent PR if desired

annotations: {}
labels: {}
keycloakUsers:
creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
annotations: {}
labels: {}
oidcClientSecret:
creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
annotations: {}
labels: {}
postgresqlDb:
creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
annotations: {}
labels: {}
rhtpa:
creationPolicy: Owner
deletionPolicy: Retain
refreshPolicy: Periodic
annotations: {}
labels: {}

# -- Default-deny NetworkPolicy for the keycloak namespace.
# When enabled, deploys a namespace-wide NetworkPolicy that blocks all ingress and egress
Expand Down