c857dbd9e1
PR #34 renamed the public chat/triage hosts in hermes_access_oidc_ensure.sh (chat.bstein.dev, triage.bstein.dev) but the last applied hermes-access-oidc-client-ensure Job predates that change, so Keycloak still has the old redirect_uri/webOrigins/rootUrl registered for hermes-chat-proxy and hermes-triage-proxy. Live check confirms Keycloak returns HTTP 400 Invalid parameter: redirect_uri for both new hosts. Bump the Job name to force Flux to recreate the (immutable) Job and rerun the ensure script, matching this repo's established retry convention for this Job (ensure-7..ensure-10). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
64 lines
2.2 KiB
YAML
64 lines
2.2 KiB
YAML
# services/keycloak/bootstrap-jobs/hermes-access-oidc-client-job.yaml
|
|
# Purpose: create Hermes browser clients and its automation identity.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: hermes-access-oidc-client-ensure-11
|
|
namespace: sso
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/agent-requests-cpu: "25m"
|
|
vault.hashicorp.com/agent-limits-cpu: "100m"
|
|
vault.hashicorp.com/role: sso-secrets
|
|
vault.hashicorp.com/agent-inject-secret-keycloak-admin-env.sh: kv/data/atlas/shared/keycloak-admin
|
|
vault.hashicorp.com/agent-inject-template-keycloak-admin-env.sh: |
|
|
{{ with secret "kv/data/atlas/shared/keycloak-admin" }}
|
|
export KEYCLOAK_ADMIN="{{ .Data.data.username }}"
|
|
export KEYCLOAK_ADMIN_USER="{{ .Data.data.username }}"
|
|
export KEYCLOAK_ADMIN_PASSWORD="{{ .Data.data.password }}"
|
|
{{ end }}
|
|
spec:
|
|
serviceAccountName: mas-secrets-ensure
|
|
restartPolicy: Never
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/arch
|
|
operator: In
|
|
values:
|
|
- arm64
|
|
- key: node-role.kubernetes.io/worker
|
|
operator: Exists
|
|
- key: hardware
|
|
operator: In
|
|
values:
|
|
- rpi5
|
|
containers:
|
|
- name: apply
|
|
image: bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
|
|
command:
|
|
- /scripts/hermes_access_oidc_ensure.sh
|
|
volumeMounts:
|
|
- name: script
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: script
|
|
configMap:
|
|
name: hermes-access-oidc-script
|
|
defaultMode: 0555
|