fix: dynamic OIDC clientId via Helm helpers for qtodo and rh-keycloak

charts/qtodo/templates/_helpers.tpl

@@ -33,6 +33,21 @@ Generate the URL of the OIDC service
 {{- end }}
 {{- end }}
 
+{{/*
+Generate the OIDC Client ID based on provider and authentication method
+*/}}
+{{- define "qtodo.oidc.clientId" }}
+{{- if .Values.app.oidc.clientId }}
+{{- print .Values.app.oidc.clientId }}
+{{- else if eq .Values.app.oidc.provider "entraid" }}
+{{- fail "app.oidc.clientId is required when using Entra ID provider" }}
+{{- else if .Values.app.oidc.clientAssertion.enabled }}
+{{- printf "spiffe://apps.%s/ns/%s/sa/qtodo" .Values.global.clusterDomain .Release.Namespace }}
+{{- else }}
+{{- print "qtodo-app" }}
+{{- end }}
+{{- end }}
+
 {{/*
 Generate the JWT Audience for SPIFFE authentication
 */}}

charts/qtodo/templates/app-config-env.yaml

@@ -7,7 +7,7 @@ data:
 {{- if eq .Values.app.oidc.enabled true }}
   QUARKUS_OIDC_ENABLED: "true"
   QUARKUS_OIDC_AUTH_SERVER_URL: "{{ include "qtodo.oidc.url" . }}"
-  QUARKUS_OIDC_CLIENT_ID: "{{ .Values.app.oidc.clientId }}"
+  QUARKUS_OIDC_CLIENT_ID: "{{ include "qtodo.oidc.clientId" . }}"
   QUARKUS_OIDC_APPLICATION_TYPE: "{{ .Values.app.oidc.applicationType }}"
   QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_PATHS: "{{ .Values.app.oidc.authenticatedPaths }}"
   QUARKUS_HTTP_AUTH_PERMISSION_AUTHENTICATED_POLICY: "{{ .Values.app.oidc.authenticatedPolicy }}"

charts/qtodo/values.yaml

@@ -53,7 +53,7 @@ app:
     provider: "keycloak"
     authServerUrl: ""
     realm: "ztvp"
-    clientId: "qtodo-app"
+    clientId: ""
     applicationType: "web-app"
     authenticatedPaths: "/*"
     authenticatedPolicy: "authenticated"

charts/rh-keycloak/templates/_helpers.tpl

@@ -0,0 +1,12 @@
+{{/*
+Generate the qtodo OIDC Client ID based on provider and authentication method
+*/}}
+{{- define "rh-keycloak.qtodo.oidc.clientId" }}
+{{- if .Values.qtodo.oidc.clientId }}
+{{- print .Values.qtodo.oidc.clientId }}
+{{- else if .Values.qtodo.oidc.clientAssertion.enabled }}
+{{- printf "spiffe://apps.%s/ns/%s/sa/%s" .Values.global.clusterDomain .Values.qtodo.namespace .Values.qtodo.serviceAccount }}
+{{- else }}
+{{- print "qtodo-app" }}
+{{- end }}
+{{- end }}

charts/rh-keycloak/templates/qtodo-client-id-secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: qtodo-client-id
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+type: Opaque
+stringData:
+  client-id: "{{ include "rh-keycloak.qtodo.oidc.clientId" . }}"

charts/rh-keycloak/values.yaml

@@ -3,6 +3,15 @@ cleanup:
   enabled: true
   image: registry.redhat.io/openshift4/ose-cli-rhel9:latest
 
+# qtodo OIDC client configuration for the Keycloak realm
+qtodo:
+  namespace: qtodo
+  serviceAccount: qtodo
+  oidc:
+    clientId: ""
+    clientAssertion:
+      enabled: true
+
 # Values passed through to the rhbk subchart.
 rhbk:
   global:
@@ -67,7 +76,7 @@ rhbk:
         enabled: true
         registrationAllowed: false
         clients:
-          - clientId: qtodo-app
+          - clientId: ${QTODO_CLIENT_ID}
             enabled: true
             name: qtodo
             protocol: openid-connect
@@ -506,6 +515,10 @@ rhbk:
         secret:
           name: rhtpa-oidc-cli-secret
           key: client-secret
+      QTODO_CLIENT_ID:
+        secret:
+          name: qtodo-client-id
+          key: client-id
       ACS_CLIENT_SECRET:
         secret:
           name: acs-oidc-client-secret