From 1dbca041371dad591e2850d0cdb894c4396f231f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andr=C3=A9s=20=C3=81lvarez?=
 <1671935+kir4h@users.noreply.github.com>
Date: Thu, 4 Apr 2019 09:52:51 +0200
Subject: [PATCH] Allow using an existing secret for keycloak admin (#12795)

Signed-off-by: Andres Alvarez <1671935+kir4h@users.noreply.github.com>
---
 stable/keycloak/Chart.yaml                     | 2 +-
 stable/keycloak/README.md                      | 4 +++-
 stable/keycloak/templates/keycloak-secret.yaml | 6 ++++--
 stable/keycloak/templates/statefulset.yaml     | 6 +++++-
 stable/keycloak/values.yaml                    | 8 +++++++-
 5 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/stable/keycloak/Chart.yaml b/stable/keycloak/Chart.yaml
index 4972f5b603..f165943209 100644
--- a/stable/keycloak/Chart.yaml
+++ b/stable/keycloak/Chart.yaml
@@ -1,5 +1,5 @@
 name: keycloak
-version: 4.8.0
+version: 4.9.0
 appVersion: 5.0.0
 description: Open Source Identity and Access Management For Modern Applications and Services
 keywords:
diff --git a/stable/keycloak/README.md b/stable/keycloak/README.md
index a7dad4fae2..dfc45a76f9 100644
--- a/stable/keycloak/README.md
+++ b/stable/keycloak/README.md
@@ -51,7 +51,9 @@ Parameter | Description | Default
 `keycloak.image.pullSecrets` | Image pull secrets | `[]`
 `keycloak.basepath` | Path keycloak is hosted at | `auth`
 `keycloak.username` | Username for the initial Keycloak admin user | `keycloak`
-`keycloak.password` | Password for the initial Keycloak admin user. If not set, a random 10 characters password is created | `""`
+`keycloak.password` | Password for the initial Keycloak admin user (if `keycloak.existingSecret=""`). If not set, a random 10 characters password is created | `""`
+`keycloak.existingSecret` | Specifies an existing secret to be used for the admin password | `""`
+`keycloak.existingSecretKey` |  The key in `keycloak.existingSecret` that stores the admin password | `password`
 `keycloak.extraInitContainers` | Additional init containers, e. g. for providing themes, etc. Passed through the `tpl` function and thus to be configured a string | `""`
 `keycloak.extraContainers` | Additional sidecar containers, e. g. for a database proxy, such as Google's cloudsql-proxy. Passed through the `tpl` function and thus to be configured a string | `""`
 `keycloak.extraEnv` | Allows the specification of additional environment variables for Keycloak. Passed through the `tpl` function and thus to be configured a string | `""`
diff --git a/stable/keycloak/templates/keycloak-secret.yaml b/stable/keycloak/templates/keycloak-secret.yaml
index 7346d749a3..4598643d1f 100644
--- a/stable/keycloak/templates/keycloak-secret.yaml
+++ b/stable/keycloak/templates/keycloak-secret.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.keycloak.existingSecret -}}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -10,7 +11,8 @@ metadata:
 type: Opaque
 data:
 {{- if .Values.keycloak.password }}
-  password: {{ .Values.keycloak.password | b64enc | quote }}
+        {{ .Values.keycloak.existingSecretKey }}: {{ .Values.keycloak.password | b64enc | quote }}
 {{- else }}
-  password: {{ randAlphaNum 10 | b64enc | quote }}
+        {{ .Values.keycloak.existingSecretKey }}: {{ randAlphaNum 10 | b64enc | quote }}
 {{- end }}
+{{- end}}
diff --git a/stable/keycloak/templates/statefulset.yaml b/stable/keycloak/templates/statefulset.yaml
index 9e2fcb9170..cff4d233b0 100644
--- a/stable/keycloak/templates/statefulset.yaml
+++ b/stable/keycloak/templates/statefulset.yaml
@@ -78,8 +78,12 @@ spec:
             - name: KEYCLOAK_PASSWORD
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.keycloak.existingSecret }}
+                  name: {{ .Values.keycloak.existingSecret }}
+                  {{- else }}
                   name: {{ template "keycloak.fullname" . }}-http
-                  key: password
+                  {{- end }}
+                  key: {{ .Values.keycloak.existingSecretKey }}
           {{- end }}
           {{- if $highAvailability }}
             - name: JGROUPS_DISCOVERY_PROTOCOL
diff --git a/stable/keycloak/values.yaml b/stable/keycloak/values.yaml
index 8b043443c2..0999a5c38d 100644
--- a/stable/keycloak/values.yaml
+++ b/stable/keycloak/values.yaml
@@ -49,10 +49,16 @@ keycloak:
   ## Username for the initial Keycloak admin user
   username: keycloak
 
-  ## Password for the initial Keycloak admin user
+  ## Password for the initial Keycloak admin user. Applicable only if existingSecret is not set.
   ## If not set, a random 10 characters password will be used
   password: ""
 
+  # Specifies an existing secret to be used for the admin password
+  existingSecret: ""
+
+  # The key in the existing secret that stores the password
+  existingSecretKey: password
+
   ## Allows the specification of additional environment variables for Keycloak
   extraEnv: |
     # - name: KEYCLOAK_LOGLEVEL