StringData

Official example

apiVersion: v1
kind: Secret
metadata:
  name: secret-basic-auth
type: kubernetes.io/basic-auth
stringData:
  username: admin # required field for kubernetes.io/basic-auth
  password: t0p-Secret # required field for kubernetes.io/basic-auth

Temporal web OIDC

 # OIDC ENABLED
web:
  additionalEnvSecretName: temporal-web-sso-kc
 
  # Configuration for self signed certificates in your identity provider:
  #  
  # kubectl get secret YOUR_KEYCLOAK_TLS_SECRET_NAME -n YOUR_NAMESPACE -o jsonpath='{.data.ca\.crt}' | base64 -d >  /tmp/your_keycloak_cert.crt
  # openssl x509 -in /tmp/your_keycloak_cert.crt -noout -subject -issuer
  # cat /etc/ssl/certs/ca-certificates.crt /tmp/your_keycloak_cert > ca-bundle.crt
  #
  # kubectl create configmap temporal-ca-bundle --from-file=ca-bundle.crt -n YOUR_NAMESPACE

  additionalEnv:
    - name: SSL_CERT_FILE
      value: /custom-ca/ca-bundle.crt
  additionalVolumes:
    - name: temporal-ca
      configMap:
        name: temporal-ca-bundle
  additionalVolumeMounts:
    - name: temporal-ca
      mountPath: /custom-ca
      readOnly: true
  
# OIDC configuration 
extraObjects:
  - apiVersion: v1
    kind: Secret
    metadata:
      name: temporal-web-sso-kc
    stringData:
      TEMPORAL_AUTH_ENABLED: "true"
      TEMPORAL_AUTH_CLIENT_ID: "temporal"
      TEMPORAL_AUTH_CLIENT_SECRET: "XXXXXXX"        # kcadm.sh get clients -r YourRealm --fields clientId,secret
      TEMPORAL_AUTH_SCOPES: "openid,profile,email"
      TEMPORAL_AUTH_ISSUER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_PROVIDER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_CALLBACK_URL: "https://temporal.example.orgo/auth/sso/callback"

Related

• extraObjects

See also

• kind: Secret: type: Opaque