From 6c99eb452e033f7972bab58dd0f719f043f6d282 Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 8 Jan 2026 02:21:37 -0300
Subject: [PATCH] keycloak: make MAS secret job idempotent

---
 services/keycloak/mas-secrets-ensure-job.yaml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/services/keycloak/mas-secrets-ensure-job.yaml b/services/keycloak/mas-secrets-ensure-job.yaml
index 8098062..dc5f92f 100644
--- a/services/keycloak/mas-secrets-ensure-job.yaml
+++ b/services/keycloak/mas-secrets-ensure-job.yaml
@@ -8,14 +8,15 @@ metadata:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-secrets-ensure-4
+  name: mas-secrets-ensure-5
   namespace: sso
 spec:
-  backoffLimit: 2
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 3600
   template:
     spec:
       serviceAccountName: mas-secrets-ensure
-      restartPolicy: OnFailure
+      restartPolicy: Never
       volumes:
         - name: work
           emptyDir: {}
@@ -95,7 +96,8 @@ spec:
                 --from-file=encryption=/work/encryption \
                 --from-file=matrix_shared_secret=/work/matrix_shared_secret \
                 --from-file=keycloak_client_secret=/work/keycloak_client_secret \
-                --from-file=rsa_key=/work/rsa_key >/dev/null
+                --from-file=rsa_key=/work/rsa_key \
+                --dry-run=client -o yaml | kubectl -n comms apply -f - >/dev/null
           volumeMounts:
             - name: work
               mountPath: /work