{{- if not .Values.identity.useExistingSecret }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include "plugin-identity.fullname" . }}
  labels:
    {{- include "plugin-identity.labels" (dict "context" . "name" .Values.identity.name ) | nindent 4 }}
type: Opaque
data:
  # -- Default sensitive variables for the identity
  AUTHORIZER_CLIENT_SECRET: {{ required "identity.secrets.AUTHORIZER_CLIENT_SECRET is required" .Values.identity.secrets.AUTHORIZER_CLIENT_SECRET | b64enc | quote }}
  {{- /* Google Workspace directory (identity 3.12.0+). Each key renders only
     when set, so an install that leaves them empty gets the same Secret as
     before. Identity reads them only with GOOGLE_DIRECTORY_ENABLED=true. */}}
  {{- with .Values.identity.secrets.GOOGLE_DIRECTORY_CLIENT_SECRET }}
  GOOGLE_DIRECTORY_CLIENT_SECRET: {{ . | b64enc | quote }}
  {{- end }}
  {{- with .Values.identity.secrets.GOOGLE_DIRECTORY_ENCRYPTION_KEY }}
  GOOGLE_DIRECTORY_ENCRYPTION_KEY: {{ . | b64enc | quote }}
  {{- end }}
  LICENSE_KEY: {{ .Values.identity.secrets.LICENSE_KEY | b64enc | quote }}
  ORGANIZATION_IDS: {{ .Values.identity.secrets.ORGANIZATION_IDS | b64enc | quote }}
  {{- if .Values.identity.secrets.REDIS_PASSWORD }}
  REDIS_PASSWORD: {{ .Values.identity.secrets.REDIS_PASSWORD | b64enc | quote }}
  {{- end }}
  SD_TOKEN: {{ .Values.identity.secrets.SD_TOKEN | default "" | b64enc | quote }}
{{- end }}