#
# Plain K8s Secret template to generate the actual SealedSecret to be
# instantiated in the cluster. To generate the SealedSecret, first edit
# the content in the `data` stanza below, then run
#
#   $ kubeseal -o yaml < templates/argocd.yaml > argocd.yaml
#
# Notice `kubeseal` needs to be able to access the cluster for that to
# work. You can also work offline if you like, but you'll have to fetch
# the controller pub key with `kubeseal --fetch-cert` beforehand. Read
# the docs for the details.
#
# WARNING. **Never** commit this file to the repo with an actual
# password in it. After editing this file, just ask git to ditch
# the local changes.
#
apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-secret
    app.kubernetes.io/part-of: argocd
  annotations:
    # Let Sealed Secrets Controller update this Secret whenever the
    # corresponding SealedSecret changes. When we update a SealedSecret,
    # Controller will extract its Secret, but if the old Secret currently
    # live in K8s doesn't have this annotation, Controller will refuse to
    # update it with the new content just unsealed.
    sealedsecrets.bitnami.com/managed: "true"
type: Opaque
data:
  # bcrypt hash of the admin password and its last modified time (required).
  # Both encoded in Base64.
  # Autogenerated to be the name of the argocd-server pod when missing.
  admin.password: JDJhJDEyJHJ0NE1QbDFrbmtUY1hNWGFKWkx3Wi5xc1Q0SzhLbjJsUG9Wc2UwUlhoM0lNOHRERjJCNnNP
  admin.passwordMtime: MjAyMS0xMS0xOVQxNzo0ODowNFo=

  # Base64-encoded secret of the Argo CD client in Keycloak.
  # We use it to enable Argo CD SSO with Keycloak.
  # See `argocd-cm.yaml` and `argocd-rbac-cm`.
  oidc.keycloak.clientSecret: S3NxUDBwNVRldkJQdGlITE1YVUpCQ2l1Ykd1dGdwaWI=

  # random server signature key for session validation (required).
  server.secretkey: RDZhSngxTnRXYnZKT3R6VzRrSTdHbVczUVpEbW5GV2I0RnVkYU5Ma2pZUT0=
