apiVersion: v1
kind: Secret
metadata:
  name: knoe-auth-oidc-signing
  namespace: knoe-system
  labels:
    app.kubernetes.io/managed-by: knoe-installer
# OIDC RS256 signing key for knoe-auth acting as OIDC provider (Phase 2).
# The signing key is a base64-encoded PKCS#8 RSA private key (2048-bit minimum).
#
# Generate a fresh key:
#   openssl genrsa -out oidc-signing.pem 2048
#   openssl pkcs8 -topk8 -nocrypt -in oidc-signing.pem -out oidc-signing-pkcs8.pem
#   SIGNING_KEY=$(base64 -w0 < oidc-signing-pkcs8.pem)
#
# Store the real value in OpenBao:
#   bao kv put knoe/oauth2/knoe-auth-oidc-signing signing-key="$SIGNING_KEY"
#
# Then create the secret from OpenBao:
#   kubectl create secret generic knoe-auth-oidc-signing \
#     --namespace knoe-system \
#     --from-literal=signing-key="$(bao kv get -field=signing-key knoe/oauth2/knoe-auth-oidc-signing)"
type: Opaque
stringData:
  signing-key: "CHANGE_ME_BASE64_PKCS8_RSA_PRIVATE_KEY"