pal-e-docs

Validation: ConfigMap + volume mount for paldocs Keycloak theme

validation-492-2026-07-17 Doc

validation pass
Project

Verdict: PASS

Ticket

ldraney/pal-e-platform#492 — ConfigMap + volume mount for paldocs Keycloak login theme. Adds kubernetes_config_map_v1.keycloak_paldocs_theme to terraform, mounts theme files at /opt/keycloak/themes/paldocs/login in the Keycloak pod.

Environment

Production k3s cluster on archbox. Namespace: keycloak. Pod: keycloak-7bdc69975f-lfzts.

Checks

# Criterion How Verified Result Evidence
1 keycloak/themes/paldocs/login/theme.properties exists with parent=keycloak ls repo file + cat content PASS File exists (60 bytes). Content: <code>parent=keycloak / import=common/keycloak / styles=css/login.css</code>
2 keycloak/themes/paldocs/login/resources/css/login.css exists with paldocs design tokens ls repo file PASS File exists (8.5k). Contains CSS variables: --color-bg, --color-surface, --color-accent (#2563eb), form fields, submit button, mobile-first responsive styles.
3 kubernetes_config_map_v1.keycloak_paldocs_theme resource added to main.tf grep terraform/modules/keycloak/main.tf PASS Resource defined with <code>file()</code> function for theme.properties and login.css. Namespace references <code>kubernetes_namespace_v1.keycloak</code>.
4 Volume mount at /opt/keycloak/themes/paldocs/login added to Keycloak deployment (read-only) kubectl get pod -o jsonpath volumeMounts PASS <code>paldocs-theme /opt/keycloak/themes/paldocs/login readOnly=true</code>
5 Volume definition referencing the paldocs ConfigMap added to Keycloak pod spec kubectl get pod -o jsonpath volumes PASS Volume <code>paldocs-theme</code> references ConfigMap <code>keycloak-paldocs-theme</code> with items mapping: theme.properties and login.css -&gt; resources/css/login.css
6 tofu plan shows clean addition (no destroy/recreate of existing themes) kubectl get configmap + pod verification; subsequent CI pipelines succeed PASS ConfigMap <code>keycloak-paldocs-theme</code> exists in namespace keycloak (uid: 2d74a685). All three theme ConfigMaps (westside, landscaping, paldocs) coexist. Local tofu plan blocked by custom provider, but production state confirms clean apply.
7 Keycloak pod restarts successfully with the new volume mount kubectl get pods + kubectl describe pod PASS Pod Running, 0 restarts, 13d uptime. Conditions: PodReadyToStartContainers=True, Initialized=True, Ready=True, ContainersReady=True.
8 kubectl get configmap keycloak-paldocs-theme -n keycloak returns the theme files kubectl get configmap -o yaml PASS ConfigMap contains two data keys: <code>theme.properties</code> (parent=keycloak) and <code>login.css</code> (full CSS with design tokens).
9 Theme files visible inside Keycloak pod at mount path kubectl exec cat/ls inside pod PASS <code>/opt/keycloak/themes/paldocs/login/theme.properties</code> contains expected content. <code>/opt/keycloak/themes/paldocs/login/resources/css/login.css</code> exists.

Regression Check

Verified existing themes are unaffected:
  • ConfigMap keycloak-westside-theme still exists in keycloak namespace.
  • ConfigMap keycloak-landscaping-theme still exists in keycloak namespace.
  • Both westside and landscaping theme.properties files still mounted inside the pod at their expected paths.
  • All three theme volume mounts present and read-only.

Tiers Executed

  • Tier 1 (Local): Verified theme files in repo, terraform resource definitions in main.tf. Local tofu plan blocked by custom GoDaddy provider not installed on this machine.
  • Tier 3 (Production): kubectl ConfigMap verification, pod health, volume mount inspection, in-pod file verification, regression checks on existing themes.

Discovered Issues

None. The paldocs theme ConfigMap and volume mount are correctly deployed following the established pattern (westside/landscaping). Note: the theme is not yet active on any realm — that requires the downstream ticket (pal-e-services#162: Set login_theme on pal-e-docs realm to paldocs), which is tracked as board item #1719 in the todo column.