apiVersion: v1
kind: ConfigMap
metadata:
  name: keycloak-db-secret-sync
  namespace: keycloak
data:
  sync.sh: |
    #!/bin/sh
    set -eu

    until kubectl -n shared-db get secret shared-postgresql-superuser-secret >/dev/null 2>&1; do
      sleep 5
    done

    username=$(kubectl -n shared-db get secret shared-postgresql-superuser-secret -o jsonpath='{.data.username}' | base64 -d)
    password=$(kubectl -n shared-db get secret shared-postgresql-superuser-secret -o jsonpath='{.data.password}' | base64 -d)

    kubectl create secret generic keycloak-db-secret \
      --namespace keycloak \
      --from-literal=username="${username}" \
      --from-literal=password="${password}" \
      --dry-run=client -o yaml | kubectl -n keycloak apply -f -