From 283ee26e32479b98ea1b2f350a74233bdaf60541 Mon Sep 17 00:00:00 2001
From: Manuel Lorenzo <mlorenzofr@redhat.com>
Date: Fri, 17 Jul 2026 14:55:04 +0200
Subject: [PATCH] fix: dynamic OIDC clientId via Helm helpers for qtodo and
 rh-keycloak

Add template helpers that derive the OIDC client ID from the provider
and authentication method instead of requiring a static override.
When client assertion is enabled the SPIFFE URI is generated from
the cluster domain, namespace and service account. The rh-keycloak
chart feeds the resolved value into a realmPlaceholder secret so the
Keycloak realm import picks it up at deploy time.

Signed-off-by: Manuel Lorenzo <mlorenzofr@redhat.com>
---
 charts/qtodo/templates/_helpers.tpl               | 15 +++++++++++++++
 charts/qtodo/templates/app-config-env.yaml        |  2 +-
 charts/qtodo/values.yaml                          |  2 +-
 charts/rh-keycloak/templates/_helpers.tpl         | 12 ++++++++++++
 .../templates/qtodo-client-id-secret.yaml         | 10 ++++++++++
 charts/rh-keycloak/values.yaml                    | 15 ++++++++++++++-
 6 files changed, 53 insertions(+), 3 deletions(-)
 create mode 100644 charts/rh-keycloak/templates/_helpers.tpl
 create mode 100644 charts/rh-keycloak/templates/qtodo-client-id-secret.yaml

diff --git a/charts/qtodo/templates/_helpers.tpl b/charts/qtodo/templates/_helpers.tpl
index 420a1325..0bfd247a 100644
--- a/charts/qtodo/templates/_helpers.tpl
+++ b/charts/qtodo/templates/_helpers.tpl
@@ -33,6 +33,21 @@ Generate the URL of the OIDC service
 {{- end }}
 {{- end }}
 
+{{/*
+Generate the OIDC Client ID based on provider and authentication method
+*/}}
+{{- define "qtodo.oidc.clientId" }}
+{{- if .Values.app.oidc.clientId }}
+{{- print .Values.app.oidc.clientId }}
+{{- else if eq .Values.app.oidc.provider "entraid" }}
+{{- fail "app.oidc.clientId is required when using Entra ID provider" }}
+{{- else if .Values.app.oidc.clientAssertion.enabled }}
+{{- printf "spiffe://apps.%s/ns/%s/sa/qtodo" .Values.global.clusterDomain .Release.Namespace }}
+{{- else }}
+{{- print "qtodo-app" }}
+{{- end }}
+{{- end }}
+
 {{/*
 Generate the JWT Audience for SPIFFE authentication
 */}}
diff --git a/charts/qtodo/templates/app-config-env.yaml b/charts/qtodo/templates/app-config-env.yaml
index 6e3e6b86..913628f9 100644
--- a/charts/qtodo/templates/app-config-env.yaml
+++ b/charts/qtodo/templates/app-config-env.yaml
@@ -7,7 +7,7 @@ data:
 {{- if eq .Values.app.oidc.enabled true }}
   QUARKUS_OIDC_ENABLED: "true"
   QUARKUS_OIDC_AUTH_SERVER_URL: "{{ include "qtodo.oidc.url" . }}"
-  QUARKUS_OIDC_CLIENT_ID: "{{ .Values.app.oidc.clientId }}"
+  QUARKUS_OIDC_CLIENT_ID: "{{ include "qtodo.oidc.clientId" . }}"
   QUARKUS_OIDC_APPLICATION_TYPE: "{{ .Values.app.oidc.applicationType }}"
   QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_PATHS: "{{ .Values.app.oidc.authenticatedPaths }}"
   QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_POLICY: "{{ .Values.app.oidc.authenticatedPolicy }}"
diff --git a/charts/qtodo/values.yaml b/charts/qtodo/values.yaml
index 953ff2ec..27a2ea7d 100644
--- a/charts/qtodo/values.yaml
+++ b/charts/qtodo/values.yaml
@@ -53,7 +53,7 @@ app:
     provider: "keycloak"
     authServerUrl: ""
     realm: "ztvp"
-    clientId: "qtodo-app"
+    clientId: ""
     applicationType: "web-app"
     authenticatedPaths: "/*"
     authenticatedPolicy: "authenticated"
diff --git a/charts/rh-keycloak/templates/_helpers.tpl b/charts/rh-keycloak/templates/_helpers.tpl
new file mode 100644
index 00000000..6840b399
--- /dev/null
+++ b/charts/rh-keycloak/templates/_helpers.tpl
@@ -0,0 +1,12 @@
+{{/*
+Generate the qtodo OIDC Client ID based on provider and authentication method
+*/}}
+{{- define "rh-keycloak.qtodo.oidc.clientId" }}
+{{- if .Values.qtodo.oidc.clientId }}
+{{- print .Values.qtodo.oidc.clientId }}
+{{- else if .Values.qtodo.oidc.clientAssertion.enabled }}
+{{- printf "spiffe://apps.%s/ns/%s/sa/%s" .Values.global.clusterDomain .Values.qtodo.namespace .Values.qtodo.serviceAccount }}
+{{- else }}
+{{- print "qtodo-app" }}
+{{- end }}
+{{- end }}
diff --git a/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml b/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml
new file mode 100644
index 00000000..8784a99d
--- /dev/null
+++ b/charts/rh-keycloak/templates/qtodo-client-id-secret.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: qtodo-client-id
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+type: Opaque
+stringData:
+  client-id: "{{ include "rh-keycloak.qtodo.oidc.clientId" . }}"
diff --git a/charts/rh-keycloak/values.yaml b/charts/rh-keycloak/values.yaml
index 94bcface..a9909196 100644
--- a/charts/rh-keycloak/values.yaml
+++ b/charts/rh-keycloak/values.yaml
@@ -3,6 +3,15 @@ cleanup:
   enabled: true
   image: registry.redhat.io/openshift4/ose-cli-rhel9:latest
 
+# qtodo OIDC client configuration for the Keycloak realm
+qtodo:
+  namespace: qtodo
+  serviceAccount: qtodo
+  oidc:
+    clientId: ""
+    clientAssertion:
+      enabled: true
+
 # Values passed through to the rhbk subchart.
 rhbk:
   global:
@@ -67,7 +76,7 @@ rhbk:
         enabled: true
         registrationAllowed: false
         clients:
-          - clientId: qtodo-app
+          - clientId: ${QTODO_CLIENT_ID}
             enabled: true
             name: qtodo
             protocol: openid-connect
@@ -506,6 +515,10 @@ rhbk:
         secret:
           name: rhtpa-oidc-cli-secret
           key: client-secret
+      QTODO_CLIENT_ID:
+        secret:
+          name: qtodo-client-id
+          key: client-id
       ACS_CLIENT_SECRET:
         secret:
           name: acs-oidc-client-secret