From 96ff8968e9caa53ef396ba05077c4fe748ebb2b4 Mon Sep 17 00:00:00 2001
From: Kochetkov S <kochetkov.s@sarex.io>
Date: Wed, 26 Aug 2026 14:17:25 +0300
Subject: [PATCH] ++ compose keycloak-password into the policy-allowed
 camunda/postgresql secret

---
 infrastructure-secrets.yaml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/infrastructure-secrets.yaml b/infrastructure-secrets.yaml
index c5865da..7abd45c 100644
--- a/infrastructure-secrets.yaml
+++ b/infrastructure-secrets.yaml
@@ -3409,6 +3409,10 @@ environments:
                     source:
                         kind: secret_ref
                         ref: vault://postgresql/admin#postgres-password
+                keycloak-password:
+                    source:
+                        kind: secret_ref
+                        ref: vault://camunda/_keycloak_db#password
               source:
                 kind: postgresql_user
                 ref:
@@ -3448,8 +3452,8 @@ sops:
             U1hiSTkrMzRwMGpOeGtYNnNyNElYOE0KOHsFrj5+iMx8tIymrIhLpB8xbLaztR7J
             E+ViNs6OGeIS90qwxAD7OP9raGB/lsTfh9V/zigM8gF+OzGErF73aQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T11:02:57Z"
-    mac: ENC[AES256_GCM,data:EZ4ZH7f9rbft7ZiGpWQIRGOOC85eShvjSPr1FBHUUZp8ULj520GttwTQZMafzBbEhuc69eAC4vS34ZcdfHtU2JacmLUZynLT2dzWQprMwqqeft/40jLJTTJkmjFFEcqOOioIVkL/9diCrb7U6BlBMzwNpOVHs7sx7FFgzssvBDE=,iv:eM/B/l+ZAow39Likb8ZTqqU1YAFa2hGnLJHAh32OKIo=,tag:iZgKo2seNYpHe2UQm9UqTA==,type:str]
+    lastmodified: "2026-08-26T11:17:08Z"
+    mac: ENC[AES256_GCM,data:k0NnmWa7QIeIXDjPogRMWPzPWDEMf5I/uj6S3lzctdLMgYE79Q72Iz7yHjqw1kLj2o6JU36V+/aIUJj3PkrCmzuhVHphc+5FGOrmWC/tPTOd18DB39uag7PiOndSmQavJrKKOBWUhIbu/iiRjzMoT2Gv3DeheMMGXldyNVztC84=,iv:6JWBlfZYVp0pojw9mhY5zMuUyqT0Alz0+doNmOEhmM0=,tag:7Xio7ugDlodcpQ4rsdTnIA==,type:str]
     pgp: []
     encrypted_regex: ^(data)$
     version: 3.12.2