{{- if not .Values.auth.useExistingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "plugin-auth.fullname" . }}
  labels:
    {{- include "plugin-auth.labels" (dict "context" . "name" .Values.auth.name ) | nindent 4 }}
type: Opaque
data:
  # -- Default sensitive variables for the auth
  AUTHORIZER_CLIENT_SECRET: {{ required "auth.secrets.AUTHORIZER_CLIENT_SECRET is required" .Values.auth.secrets.AUTHORIZER_CLIENT_SECRET | b64enc | quote }}
  REDIS_PASSWORD: {{ .Values.auth.secrets.REDIS_PASSWORD | default "" | b64enc | quote }}
  # DB_PASSWORD is single-sourced from the auth-database Secret this chart keeps
  # (<release>-auth-database, key "password") and read via secretKeyRef by caradhras
  # and init-user workloads; see docs/helm-chart-standard.md
  # "Single-Source Infra Secrets". It is only written here for an EXTERNAL database
  # (auth-database.external=true) without auth-database.auth.existingSecret.
  {{- $db := default dict (index .Values "auth-database") }}
  {{- if and (not (and (ne (toString $db.enabled) "false") (not $db.external))) (not (include "plugin-access-manager.operatorDbSecret" .)) .Values.auth.secrets.DB_PASSWORD }}
  DB_PASSWORD: {{ .Values.auth.secrets.DB_PASSWORD | b64enc | quote }}
  {{- end }}
  LICENSE_KEY: {{ .Values.auth.secrets.LICENSE_KEY | b64enc | quote }}
  ORGANIZATION_IDS: {{ .Values.auth.secrets.ORGANIZATION_IDS | b64enc | quote }}
  MFA_SECRET: {{ .Values.auth.secrets.MFA_SECRET | default "" | b64enc | quote }}
  SD_TOKEN: {{ .Values.auth.secrets.SD_TOKEN | default "" | b64enc | quote }}
{{- end }}