Validation: Deploy ISS Keycloak login theme

validation-541-2026-07-17 Doc

validation pass

Project

Verdict: PASS

Ticket

platform#541 (board item #1865 on board-iss) — Deploy ISS Keycloak login theme via ConfigMap + volume mount. Navy + gold branded login theme files deployed to the Keycloak pod following the existing landscaping/paldocs/westside pattern.

Merged PR: #542

Environment

Production cluster (archbox), namespace: keycloak, pod: keycloak-d78ffb987-7hcpz. Keycloak exposed via Tailscale funnel at keycloak.tail5b443a.ts.net.

Checks

#	Criterion	How Verified	Result	Evidence
1	Theme files copied to designated directory	<code>kubectl exec ls /opt/keycloak/themes/iss/login/</code>	PASS	Directory contains <code>resources/</code> (symlink) and <code>theme.properties</code> (symlink). Subdirs <code>resources/css/login.css</code> (12151 bytes) and <code>resources/img/logo.svg</code> (581 bytes) present.
2	ConfigMap created in Terraform configuration	<code>kubectl get configmap -n keycloak</code>	PASS	<code>keycloak-iss-theme</code> ConfigMap exists with 3 data keys: <code>login.css</code>, <code>logo.svg</code>, <code>theme.properties</code>.
3	Volume mount configured for Keycloak pod	<code>kubectl get pod -o jsonpath volumeMounts</code>	PASS	Volume <code>iss-theme</code> mounted at <code>/opt/keycloak/themes/iss/login</code>.
4	Theme accessible at /opt/keycloak/themes/iss/ post-deployment	<code>kubectl exec ls + cat theme.properties</code>	PASS	<code>theme.properties</code> reads: <code>parent=keycloak</code>, <code>import=common/keycloak</code>, <code>styles=css/login.css</code>. CSS contains ISS brand tokens (navy <code>#1b2a4a</code>, gold <code>#996d13</code>).
5	Existing landscaping theme deployment remains unchanged	<code>kubectl get configmap + kubectl exec ls</code>	PASS	<code>keycloak-landscaping-theme</code> ConfigMap exists (2 data keys). Theme files at <code>/opt/keycloak/themes/landscaping/login/</code> intact with <code>theme.properties</code> and <code>resources/css/login.css</code>.

Tier Results

Tier	Result	Evidence
Tier 1 (CI)	PASS	Woodpecker pipeline #1514 (push to main) — all steps green including <code>apply</code>. PR pipeline #1507 also green.
Tier 2 (Staging)	N/A	No staging environment for pal-e-platform.
Tier 3 (Prod)	PASS	Keycloak pod <code>keycloak-d78ffb987-7hcpz</code>: Running, 1/1 Ready, 0 restarts. ConfigMap, volume mount, and theme files all verified in-cluster. All 4 themes present: iss, landscaping, paldocs, westside.

Regression Check

Landscaping theme: ConfigMap present (2 keys), files intact in pod, theme.properties correct.
Westside theme: resources/css/westside.css present in pod.
Paldocs theme: resources/css/login.css present in pod.
Keycloak pod: 0 restarts, Running status, no CrashLoopBackOff.
Keycloak service responding (302 on auth endpoints for both ISS and landscaping realms).
Note: ISS realm login page currently renders default Keycloak theme — expected, as realm-level login_theme configuration is handled by companion ticket svc#184 (board item #1864).

Discovered Issues

None. All checks passed cleanly. The theme deployment is complete and ready for realm-level activation by svc#184.