feat: add rh-keycloak wrapper chart with PostSync cleanup for one-shot ExternalSecrets

charts/rh-keycloak/Chart.yaml

@@ -0,0 +1,17 @@
+apiVersion: v2
+name: rh-keycloak
+description: ZTVP Keycloak deployment — wraps the rhbk chart and adds PostSync cleanup for one-shot ExternalSecrets
+type: application
+version: 0.1.0
+dependencies:
+  - name: rhbk
+    version: ">=0.0.10"
+    repository: "oci://quay.io/validatedpatterns"
+maintainers:
+  - name: Zero Trust Validated Patterns Team
+    email: ztvp-arch-group@redhat.com
+keywords:
+  - keycloak
+  - rhbk
+  - zero-trust
+  - pattern

charts/rh-keycloak/templates/cleanup-externalsecrets.yaml

@@ -0,0 +1,79 @@
+{{- if .Values.cleanup.enabled }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cleanup-ephemeral-secrets
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: cleanup-ephemeral-secrets
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cleanup-ephemeral-secrets
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: cleanup-ephemeral-secrets
+subjects:
+- kind: ServiceAccount
+  name: cleanup-ephemeral-secrets
+  namespace: {{ .Release.Namespace }}
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: cleanup-ephemeral-secrets
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  backoffLimit: 2
+  activeDeadlineSeconds: {{ .Values.cleanup.activeDeadlineSeconds }}
+  template:
+    metadata:
+      labels:
+        app: cleanup-ephemeral-secrets
+    spec:
+      serviceAccountName: cleanup-ephemeral-secrets
+      restartPolicy: Never
+      containers:
+      - name: cleanup
+        image: {{ .Values.cleanup.image }}
+        command:
+        - /bin/bash
+        - -ce
+        - |
+          LABEL="{{ .Values.cleanup.label }}"
+          NS="{{ .Release.Namespace }}"
+
+          SEC_COUNT=$(oc get secret -l "${LABEL}=delete" -n "${NS}" --no-headers 2>/dev/null | wc -l)
+          if [ "${SEC_COUNT}" -eq 0 ]; then
+            echo "No ephemeral Secrets to clean up."
+          else
+            echo "Deleting ${SEC_COUNT} ephemeral Secret(s)..."
+            oc delete secret -l "${LABEL}=delete" -n "${NS}" --ignore-not-found
+          fi
+
+          echo "Cleanup complete."
+{{- end }}

charts/rh-keycloak/templates/cleanup-network-policy.yaml

@@ -0,0 +1,31 @@
+{{- if and .Values.cleanup.enabled (eq (.Values.rhbk.defaultDenyNetworkPolicy.enabled | toString) "true") }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: cleanup-ephemeral-secrets-network-policy
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/hook: PostSync
+    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
+spec:
+  podSelector:
+    matchLabels:
+      app: cleanup-ephemeral-secrets
+  policyTypes:
+  - Egress
+  egress:
+  # DNS resolution via CoreDNS
+  - ports:
+    - protocol: UDP
+      port: 5353
+    - protocol: TCP
+      port: 5353
+    to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: openshift-dns
+  # Kubernetes API server — oc get/delete secret
+  - ports:
+    - protocol: TCP
+      port: 6443
+{{- end }}

charts/rh-keycloak/values.yaml

@@ -0,0 +1,15 @@
+# PostSync cleanup for ephemeral Secrets.
+# When enabled, a PostSync Job deletes Secrets labeled for cleanup
+# (e.g. keycloak-users) after the realm import completes.
+# The ExternalSecret itself is removed by ArgoCD's HookSucceeded policy.
+cleanup:
+  enabled: true
+  image: registry.redhat.io/openshift4/ose-cli-rhel9:latest
+  label: "validatedpatterns.io/cleanup"
+  activeDeadlineSeconds: 120
+
+# Values passed through to the rhbk subchart.
+rhbk:
+  externalSecrets:
+    oneShot: true
+    secretCleanupLabel: "validatedpatterns.io/cleanup"