ELNBuildSync: Make ebs_oidc_secret an actual Secret

This also means that static-config can be a ConfigMap, rather than a
Secret since it no longer contains any sensitive data.

Also use `stringData` instead of `data` to be explicit about its format.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2

@@ -31,6 +31,7 @@ spec:
         - "--keytab-principal={{ ebs_krb5_principal }}"
         - "--keytab-path={{ ebs_keytab_file }}"
         - "--koji-profile={{ ebs_koji_profile }}"
+        - "--openid-client-secret-file={{ ebs_secrets_path }}/ebs_oidc_secret"
         startupProbe:
           httpGet:
             path: /startup
@@ -67,9 +68,8 @@ spec:
       terminationGracePeriodSeconds: 30
       volumes:
       - name: static-config
-        secret:
-          defaultMode: 420
-          secretName: static-config
+        configMap:
+          name: static-config
       - name: keytab
         secret:
           defaultMode: 420

roles/openshift-apps/elnbuildsync/templates/ebs-secrets.yml.j2

@@ -5,4 +5,5 @@ metadata:
 stringData:
   ebs_db_pw: "{{ ebs_db_password }}"
   ebs_smtp_pw: "{{ ebs_smtp_password | default('') }}"
+  ebs_oidc_secret: "{{ ebs_fedora_oidc_client_secret | default('') }}"
 type: Opaque

roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2

@@ -17,7 +17,6 @@ configuration:
   open_id_connect:
     auth_url: "https://id{{env_suffix}}.fedoraproject.org/openidc/Authorization"
     client_id: "{{ ebs_oidc_client_id }}"
-    client_secret: "{{ ebs_oidc_client_secret }}"
     token_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/Token"
     userinfo_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/UserInfo"
     # OAuth2 scopes to request (groups scope required for authorization)

roles/openshift-apps/elnbuildsync/templates/static-config.yml.j2

@@ -1,8 +1,8 @@
 ---
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: static-config
-data:
+stringData:
   elnbuildsync.yml: |
     {{ lookup('template', 'elnbuildsync_static.yml.j2') | indent }}