Refacto OAuth2

oauth2/oauth2.tf

@@ -4,9 +4,10 @@ locals {
     "app.kubernetes.io/component" = "authentik-oauth2"
   })
 }
+
 resource "random_password" "client_id" {
-  length           = 32
-  special          = false
+  length  = 32
+  special = false
 }
 
 data "authentik_certificate_key_pair" "ca" {
@@ -30,8 +31,8 @@ data "authentik_flow" "default_authentication_flow" {
 resource "authentik_provider_oauth2" "oauth2" {
   name                = local.app_slug
   client_id           = random_password.client_id.result
-  authentication_flow = data.authentik_flow.default-authentication-flow.id
-  authorization_flow  = data.authentik_flow.default-authorization-flow.id
+  authentication_flow = data.authentik_flow.default_authentication_flow.id
+  authorization_flow  = data.authentik_flow.default_authorization_flow.id
   client_type         = "confidential"
   sub_mode            = "user_username"
   signing_key         = data.authentik_certificate_key_pair.ca.id
@@ -41,40 +42,22 @@ resource "authentik_provider_oauth2" "oauth2" {
   ]
 }
 
-resource "kubernetes_secret_v1" "oauth2-client-id" {
-  metadata {
-    name      = "${local.app_slug}-id"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    client-id = random_password.client_id.result
-  }
-}
-
-resource "kubernetes_secret_v1" "oauth2-client-secret" {
-  metadata {
-    name      = "${local.app_slug}-secret"
-    namespace = var.namespace
-    labels    = local.oauth2_labels
-  }
-  data = {
-    client-id = random_password.client_id.result
-    client-secret = authentik_provider_oauth2.oauth2.client_secret
-  }
-}
-
-data "kubernetes_secret_v1" "oauth2_client_secret" {
-  depends_on = [kubernetes_secret_v1.oauth2_client_secret]
-  metadata {
-    name      = kubernetes_secret_v1.oauth2_client_secret.metadata[0].name
-    namespace = var.namespace
-  }
-}
-
 data "kubernetes_ingress_v1" "authentik" {
   metadata {
     name      = "authentik"
     namespace = "${var.domain}-auth"
   }
 }
+
+resource "kubernetes_secret" "oauth2_client_secret" {
+  metadata {
+    name      = "${local.app_slug}-oauth2"
+    namespace = var.namespace
+    labels    = local.oauth2_labels
+  }
+  data = {
+    oidc_endpoint = "https://${data.kubernetes_ingress_v1.authentik.spec[0].rule[0].host}/application/o/${local.app_slug}/"
+    client_id     = random_password.client_id.result
+    client_secret = authentik_provider_oauth2.oauth2.client_secret
+  }
+}