Split Keycloak OIDC secrets into TF-owned /oidc subpaths
Date: 2026-07-03 Status: Accepted Decision: hl-u103 Deciders: sean
Context
Section titled “Context”Seven tf/keycloak sites read-modify-wrote Keycloak client secrets into a Vault path co-owned with operator-seeded fields, using the (now deprecated) vault_kv_secret_v2 data-source readback to preserve those fields across whole-version KV-v2 writes. The provider deprecation forced a decision on how Terraform-owned and operator-owned data coexist at the same Vault path.
Decision
Section titled “Decision”Terraform writes only its own fields to a new secret/fzymgc-house/cluster/<app>/oidc path with plain, diffable data_json; the bare cluster/<app> path becomes operator-only. Old co-owned resources leave state via removed { lifecycle { destroy = false } }.
Rationale
Section titled “Rationale”- Removes the KV-v2 whole-version-replace clobber risk class structurally, not by convention
- Eliminates the deprecated read entirely for these sites while keeping full drift detection (plain data_json is not deprecated)
Alternatives Considered
Section titled “Alternatives Considered”- Split TF-owned /oidc subpath (chosen): no deprecated read, no merge, diffable writes, clobber risk gone
- Keep merged read-modify-write on shared path via ephemeral read + data_json_wo (rejected): requires manual data_json_wo_version bumps, so rotations silently fail to propagate; keeps the co-ownership hazard
Consequences
Section titled “Consequences”- Positive: operator writes can no longer clobber TF-written OIDC fields (or vice versa); /oidc paths fully diffable
- Negative: app secret material spans two Vault paths; consumers repoint (ExternalSecrets per-property; argocd splits into two reads in cluster-bootstrap)
- Neutral: operator-seeded properties stay on the bare path untouched