e49c0928d2
Per platform review (danijel):
- keycloak-client-forte-drop: add the secret{} block telling the
registrar where to write the credential Secret + key names
(forte-drop-oidc-credentials, client-id/client-secret). The
forte-helm oidc sidecar consumes that registrar-created Secret —
no manual auth-oidc SealedSecret step (removed that NOTE).
- Delete keycloak-client-forte-drop-mcp: auth.type: mcp auto-registers
the MCP client; no manual config needed.
- Re-seal forte-drop-secrets with all shared env (BASE_DOMAIN, PG*,
S3_*, PASSWORD_GATE_SECRET) so both deployments get identical values
via envSecretName (values extraEnv now carries only APP_MODE).
9 lines
380 B
YAML
9 lines
380 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- forte-drop-mcp.yaml
|
|
# No keycloak-client config + no auth-oidc Secret for mcp mode. The chart's
|
|
# auth.type: mcp auto-registers the MCP client; the sidecar is an RFC 9728
|
|
# resource server that validates tokens (no client-secret of its own).
|
|
# forte-drop-secrets (shared with web) covers PG + S3 creds.
|