bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sso(keycloak): grant portal admin client management

Browse Source
This commit is contained in:
jenkins 2026-05-21 02:43:06 -03:00
parent ccf76f2c7d
commit 85468110b3
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml
View File

@ -1,15 +1,15 @@
# services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml # services/keycloak/oneoffs/portal-admin-client-secret-ensure-job.yaml
# One-off job for sso/keycloak-portal-admin-secret-ensure-4. # One-off job for sso/keycloak-portal-admin-secret-ensure-5.
# Purpose: keycloak portal admin secret ensure 4 (see container args/env in this file). # Purpose: keycloak portal admin secret ensure 5 (see container args/env in this file).
# Run by setting spec.suspend to false, reconcile, then set it back to true. # Run by setting spec.suspend to false, reconcile, then set it back to true.
# Safe to delete the finished Job/pod; it should not run continuously. # Safe to delete the finished Job/pod; it should not run continuously.
apiVersion: batch/v1 apiVersion: batch/v1
kind: Job kind: Job
metadata: metadata:
name: keycloak-portal-admin-secret-ensure-4 name: keycloak-portal-admin-secret-ensure-5
namespace: sso namespace: sso
spec: spec:
suspend: true suspend: false
backoffLimit: 0 backoffLimit: 0
template: template:
metadata: metadata:
@ -163,7 +163,7 @@ spec:
if status not in (200, 204): if status not in (200, 204):
raise SystemExit(f"Client update failed (status={status}) resp={resp}") raise SystemExit(f"Client update failed (status={status}) resp={resp}")
# Ensure the portal admin service account can manage users. # Ensure the portal admin service account can manage users and OIDC clients.
status, svc_user = http_json( status, svc_user = http_json(
"GET", "GET",
f"{base_url}/admin/realms/{realm}/clients/{client_uuid}/service-account-user", f"{base_url}/admin/realms/{realm}/clients/{client_uuid}/service-account-user",
@ -184,7 +184,15 @@ spec:
if not rm_uuid: if not rm_uuid:
raise SystemExit("realm-management client has no id") raise SystemExit("realm-management client has no id")
wanted_roles = ("query-users", "view-users", "manage-users", "impersonation") wanted_roles = (
"query-users",
"view-users",
"manage-users",
"impersonation",
"query-clients",
"view-clients",
"manage-clients",
)
role_reps = [] role_reps = []
for role_name in wanted_roles: for role_name in wanted_roles:
status, role = http_json( status, role = http_json(