From fa6805a254e478374db0193d236fb9a9175e7293 Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Fri, 26 Jun 2026 08:21:13 -0400
Subject: [PATCH] ELNBuildSync: Make ebs_oidc_secret an actual Secret

This also means that static-config can be a ConfigMap, rather than a
Secret since it no longer contains any sensitive data.

Also use `stringData` instead of `data` to be explicit about its format.

Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED
---
 .../openshift-apps/elnbuildsync/templates/deployment.yml.j2 | 6 +++---
 .../elnbuildsync/templates/ebs-secrets.yml.j2               | 1 +
 .../elnbuildsync/templates/elnbuildsync_static.yml.j2       | 1 -
 .../elnbuildsync/templates/static-config.yml.j2             | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2 b/roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2
index 26f3784446..559d8f68f0 100644
--- a/roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2
+++ b/roles/openshift-apps/elnbuildsync/templates/deployment.yml.j2
@@ -31,6 +31,7 @@ spec:
         - "--keytab-principal={{ ebs_krb5_principal }}"
         - "--keytab-path={{ ebs_keytab_file }}"
         - "--koji-profile={{ ebs_koji_profile }}"
+        - "--openid-client-secret-file={{ ebs_secrets_path }}/ebs_oidc_secret"
         startupProbe:
           httpGet:
             path: /startup
@@ -67,9 +68,8 @@ spec:
       terminationGracePeriodSeconds: 30
       volumes:
       - name: static-config
-        secret:
-          defaultMode: 420
-          secretName: static-config
+        configMap:
+          name: static-config
       - name: keytab
         secret:
           defaultMode: 420
diff --git a/roles/openshift-apps/elnbuildsync/templates/ebs-secrets.yml.j2 b/roles/openshift-apps/elnbuildsync/templates/ebs-secrets.yml.j2
index 7b965fbfc9..52e6ddaeb9 100644
--- a/roles/openshift-apps/elnbuildsync/templates/ebs-secrets.yml.j2
+++ b/roles/openshift-apps/elnbuildsync/templates/ebs-secrets.yml.j2
@@ -5,4 +5,5 @@ metadata:
 stringData:
   ebs_db_pw: "{{ ebs_db_password }}"
   ebs_smtp_pw: "{{ ebs_smtp_password | default('') }}"
+  ebs_oidc_secret: "{{ ebs_fedora_oidc_client_secret | default('') }}"
 type: Opaque
diff --git a/roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2 b/roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2
index c095671b63..69af0c40c8 100644
--- a/roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2
+++ b/roles/openshift-apps/elnbuildsync/templates/elnbuildsync_static.yml.j2
@@ -17,7 +17,6 @@ configuration:
   open_id_connect:
     auth_url: "https://id{{env_suffix}}.fedoraproject.org/openidc/Authorization"
     client_id: "{{ ebs_oidc_client_id }}"
-    client_secret: "{{ ebs_oidc_client_secret }}"
     token_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/Token"
     userinfo_endpoint: "https://id{{env_suffix}}.fedoraproject.org/openidc/UserInfo"
     # OAuth2 scopes to request (groups scope required for authorization)
diff --git a/roles/openshift-apps/elnbuildsync/templates/static-config.yml.j2 b/roles/openshift-apps/elnbuildsync/templates/static-config.yml.j2
index fe129c513e..445cb3714f 100644
--- a/roles/openshift-apps/elnbuildsync/templates/static-config.yml.j2
+++ b/roles/openshift-apps/elnbuildsync/templates/static-config.yml.j2
@@ -1,8 +1,8 @@
 ---
 apiVersion: v1
-kind: Secret
+kind: ConfigMap
 metadata:
   name: static-config
-data:
+stringData:
   elnbuildsync.yml: |
     {{ lookup('template', 'elnbuildsync_static.yml.j2') | indent }}