#
# Plain K8s Secret template to generate the actual SealedSecret to be
# instantiated in the cluster. To generate the SealedSecret, first edit
# the password field below, then run
#
#   $ kubeseal -o yaml < templates/keycloak-builtin-admin.yaml \
#                      > keycloak-builtin-admin.yaml
#
# Notice `kubeseal` needs to be able to access the cluster for that to
# work. You can also work offline if you like, but you'll have to fetch
# the controller pub key with `kubeseal --fetch-cert` beforehand. Read
# the docs for the details.
#
# WARNING. **Never** commit this file to the repo with an actual
# password in it. After editing this file, just ask git to ditch
# the local changes.
#
apiVersion: v1
kind: Secret
metadata:
  name: keycloak-builtin-admin
  namespace: default
  annotations:
    # Let Sealed Secrets Controller update this Secret whenever the
    # corresponding SealedSecret changes. When we update a SealedSecret,
    # Controller will extract its Secret, but if the old Secret currently
    # live in K8s doesn't have this annotation, Controller will refuse to
    # update it with the new content just unsealed.
    sealedsecrets.bitnami.com/managed: "true"
type: Opaque
stringData:
  username: admin
  password: use-a-very-strong-password!
