From 32598a7ca81602c7c88b9964564882d1d267679f Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Thu, 13 Aug 2026 18:03:08 -0300
Subject: [PATCH] keycloak: prefer healthy workers for Hermes bootstrap

---
 .../bootstrap-jobs/hermes-access-oidc-client-job.yaml     | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml b/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
index 17d5c8b77..ab91fd059 100644
--- a/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
+++ b/services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
@@ -3,7 +3,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: hermes-access-oidc-client-ensure-8
+  name: hermes-access-oidc-client-ensure-9
   namespace: sso
 spec:
   backoffLimit: 3
@@ -34,10 +34,10 @@ spec:
                       - arm64
                   - key: node-role.kubernetes.io/worker
                     operator: Exists
-                  - key: kubernetes.io/hostname
-                    operator: NotIn
+                  - key: hardware
+                    operator: In
                     values:
-                      - titan-18
+                      - rpi5
       containers:
         - name: apply
           image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131