Validation: pal-e-deployments#146 — KEYCLOAK_CLIENT_SECRET landed
Ticket
forgejo_admin/pal-e-deployments#146 (PR #147, merged + ArgoCD-reconciled). Replaces the placeholder KEYCLOAK_CLIENT_SECRET in the SOPS overlay with the real 32-char value generated by the Keycloak admin console for the new westside-admin client.Environment
- Cluster: westside-admin namespace, archbox k3s
- Image SHA at validation:
63e708dc(post all 4 sub-task merges + 2 bug fixes) - ArgoCD Application: westside-admin, Synced + Healthy
Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | cluster Secret carries the 32-byte value | <code>kubectl -n westside-admin get secret westside-admin-secrets -o jsonpath='{.data.KEYCLOAK_CLIENT_SECRET}' | base64 -d | wc -c</code> | PASS | 32 (verified earlier in session) |
| 2 | OIDC token exchange against the new secret succeeds | End-to-end auth flow: /auth/login → Keycloak login → /auth/callback completes 302 → / | PASS | Live SSO round-trip rendered <code><h1>westside-admin</h1></code> on /. If the callback's confidential-client basic auth (KEYCLOAK_CLIENT_ID:KEYCLOAK_CLIENT_SECRET) had been wrong, /token would have returned 401 and the callback would have 502'd. It did not. |
| 3 | only KEYCLOAK_CLIENT_SECRET changed in the overlay | decrypted-diff vs prior | PASS | 5 stringData keys preserved (KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, COOKIE_SIGNING_KEY); only KEYCLOAK_CLIENT_SECRET ENC blob changed |
Verdict
PASS — secret landed and exercised end-to-end.
Discovered Issues
None during validation. Two bugs surfaced during the broader e2e test (cookie too big, jwt aud mismatch) — both filed and fixed (
forgejo_admin/westside-admin#24 / PR #25, forgejo_admin/westside-admin#26 / PR #27). Neither was a regression from this PR — both were pre-existing latent defects in the consuming SSR auth code.