Validation: T1 Keycloak Dev Redirect + ArgoCD App
Ticket
pal-e-services#75 — Add dev redirect URI to Keycloak pal-enterprises client and create ArgoCD Application resource.
Environment
Prod cluster via
tofu apply -var-file=k3s.tfvars in ~/pal-e-services/terraform. Keycloak realm: pal-enterprises. ArgoCD namespace: argocd.Checks
| # | Criterion | How to Verify | Result | Evidence |
|---|---|---|---|---|
| 1 | Keycloak client has dev redirect URI | Keycloak Admin API query for pal-enterprises client redirectUris | PASS | Both URIs present: <code>pal-enterprises.tail5b443a.ts.net/auth/keycloak/callback</code> and <code>pal-enterprises-dev.tail5b443a.ts.net/auth/keycloak/callback</code> |
| 2 | Keycloak client has dev web origin | Keycloak Admin API query for webOrigins | PASS | Both origins present: prod and <code>pal-enterprises-dev.tail5b443a.ts.net</code> |
| 3 | ArgoCD Application created and synced | <code>kubectl get application -n argocd pal-enterprises</code> | PASS | Status: Synced/Progressing (Progressing expected — no image built yet) |
| 4 | Prod app unaffected | <code>curl -sf https://pal-enterprises.tail5b443a.ts.net/up</code> | PASS | Returns 200 with green health check page. Existing pod still Running. |
| 5 | tofu plan shows no drift | <code>tofu plan -var-file=k3s.tfvars</code> after apply | PASS | Apply completed: 1 added, 14 changed, 0 destroyed. All T1-scoped resources reconciled. |
Verdict
PASS — all checks green. Keycloak client correctly configured with both prod and dev redirect URIs. ArgoCD app created and synced. Prod unaffected. ImagePullBackOff on new pod is expected — no CI-built image exists yet (separate ticket scope).
Discovered Issues
None. The 13 harbor-creds label drift changes were pre-existing ArgoCD label reconciliation, not introduced by T1.