gitea: tolerate oidc init failures

services/bstein-dev-home/portal-onboarding-e2e-test-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: portal-onboarding-e2e-test-13
+  name: portal-onboarding-e2e-test-14
   namespace: bstein-dev-home
 spec:
   backoffLimit: 0

services/gitea/deployment.yaml

@@ -67,9 +67,9 @@ spec:
             - -c
             - |
               set -euo pipefail
-              CLIENT_ID="$(cat /vault/secrets/gitea-oidc__client_id)"
-              CLIENT_SECRET="$(cat /vault/secrets/gitea-oidc__client_secret)"
-              DISCOVERY_URL="$(cat /vault/secrets/gitea-oidc__openid_auto_discovery_url)"
+              CLIENT_ID="$(tr -d '\r\n' </vault/secrets/gitea-oidc__client_id)"
+              CLIENT_SECRET="$(tr -d '\r\n' </vault/secrets/gitea-oidc__client_secret)"
+              DISCOVERY_URL="$(tr -d '\r\n' </vault/secrets/gitea-oidc__openid_auto_discovery_url)"
               APPINI=/data/gitea/conf/app.ini
               BIN=/usr/local/bin/gitea
 
@@ -78,7 +78,7 @@ spec:
 
               if [ -n "$id" ]; then
                 echo "Updating existing auth source id=$id"
-                $BIN -c "$APPINI" admin auth update-oauth \
+                if ! $BIN -c "$APPINI" admin auth update-oauth \
                   --id "$id" \
                   --name keycloak \
                   --provider openidConnect \
@@ -90,10 +90,12 @@ spec:
                   --required-claim-value "" \
                   --group-claim-name groups \
                   --admin-group admin \
-                  --skip-local-2fa
+                  --skip-local-2fa; then
+                  echo "OIDC update failed; continuing without blocking startup" >&2
+                fi
               else
                 echo "Creating keycloak auth source"
-                $BIN -c "$APPINI" admin auth add-oauth \
+                if ! $BIN -c "$APPINI" admin auth add-oauth \
                   --name keycloak \
                   --provider openidConnect \
                   --key "$CLIENT_ID" \
@@ -104,7 +106,9 @@ spec:
                   --required-claim-value "" \
                   --group-claim-name groups \
                   --admin-group admin \
-                  --skip-local-2fa
+                  --skip-local-2fa; then
+                  echo "OIDC create failed; continuing without blocking startup" >&2
+                fi
               fi
           volumeMounts:
             - name: gitea-data
@@ -133,9 +137,9 @@ spec:
           args:
             - |
               set -euo pipefail
-              export GITEA__security__SECRET_KEY="$(cat /vault/secrets/gitea-secret__SECRET_KEY)"
-              export GITEA__security__INTERNAL_TOKEN="$(cat /vault/secrets/gitea-secret__INTERNAL_TOKEN)"
-              export DB_PASS="$(cat /vault/secrets/gitea-db-secret__password)"
+              export GITEA__security__SECRET_KEY="$(tr -d '\r\n' </vault/secrets/gitea-secret__SECRET_KEY)"
+              export GITEA__security__INTERNAL_TOKEN="$(tr -d '\r\n' </vault/secrets/gitea-secret__INTERNAL_TOKEN)"
+              export DB_PASS="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"
               exec /usr/bin/entrypoint /usr/bin/s6-svscan /etc/s6
           ports:
             - containerPort: 3000

services/keycloak/endurain-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: endurain-oidc-secret-ensure-1
+  name: endurain-oidc-secret-ensure-2
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/harbor-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: harbor-oidc-secret-ensure-5
+  name: harbor-oidc-secret-ensure-6
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/ldap-federation-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-ldap-federation-7
+  name: keycloak-ldap-federation-8
   namespace: sso
 spec:
   backoffLimit: 2

services/keycloak/logs-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: logs-oidc-secret-ensure-4
+  name: logs-oidc-secret-ensure-5
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/mas-secrets-ensure-job.yaml

@@ -10,7 +10,7 @@ imagePullSecrets:
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: mas-secrets-ensure-16
+  name: mas-secrets-ensure-17
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/portal-e2e-client-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-portal-e2e-client-4
+  name: keycloak-portal-e2e-client-5
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/portal-e2e-execute-actions-email-test-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-portal-e2e-execute-actions-email-7
+  name: keycloak-portal-e2e-execute-actions-email-8
   namespace: sso
 spec:
   backoffLimit: 3

services/keycloak/portal-e2e-target-client-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-portal-e2e-target-3
+  name: keycloak-portal-e2e-target-4
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/portal-e2e-token-exchange-permissions-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-portal-e2e-token-exchange-permissions-7
+  name: keycloak-portal-e2e-token-exchange-permissions-8
   namespace: sso
 spec:
   backoffLimit: 6

services/keycloak/portal-e2e-token-exchange-test-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-portal-e2e-token-exchange-test-3
+  name: keycloak-portal-e2e-token-exchange-test-4
   namespace: sso
 spec:
   backoffLimit: 6

services/keycloak/realm-settings-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-realm-settings-19
+  name: keycloak-realm-settings-20
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/sparkyfitness-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: sparkyfitness-oidc-secret-ensure-1
+  name: sparkyfitness-oidc-secret-ensure-2
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/synapse-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: synapse-oidc-secret-ensure-6
+  name: synapse-oidc-secret-ensure-7
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/user-overrides-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: keycloak-user-overrides-3
+  name: keycloak-user-overrides-4
   namespace: sso
 spec:
   backoffLimit: 0

services/keycloak/vault-oidc-secret-ensure-job.yaml

@@ -2,7 +2,7 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
-  name: vault-oidc-secret-ensure-3
+  name: vault-oidc-secret-ensure-4
   namespace: sso
 spec:
   backoffLimit: 0