From e9fb11af40bbd6fb30f909be3493c1ecb2ffe333 Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 8 Jan 2026 02:19:21 -0300
Subject: [PATCH] keycloak: allow MAS secret apply read access

---
 services/keycloak/mas-secrets-ensure-job.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/keycloak/mas-secrets-ensure-job.yaml b/services/keycloak/mas-secrets-ensure-job.yaml
index 8e43cbf..8098062 100644
--- a/services/keycloak/mas-secrets-ensure-job.yaml
+++ b/services/keycloak/mas-secrets-ensure-job.yaml
@@ -8,7 +8,7 @@ metadata:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-secrets-ensure-3
+  name: mas-secrets-ensure-4
   namespace: sso
 spec:
   backoffLimit: 2
@@ -66,7 +66,7 @@ spec:
               openssl rand -base64 32 > /work/encryption
               openssl rand -hex 32 > /work/matrix_shared_secret
               openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out /work/rsa_key >/dev/null 2>&1
-              chmod 0600 /work/*
+              chmod 0644 /work/*
           env:
             - name: KEYCLOAK_ADMIN
               valueFrom: