Validation: ISS realm config login_theme + verify_email

validation-svc184-2026-07-17 Doc

validation partial

Project

Verdict: PARTIAL

Ticket

svc#184 (PR #187) — Add login_theme = "iss" and verify_email = true to the ISS Keycloak realm config in pal-e-services terraform.

Board item: #1864 on board-iss

Environment

Production cluster. Keycloak at keycloak.tail5b443a.ts.net, ISS realm name iss. ISS app at intelligentstaffingsystems.tail5b443a.ts.net.

Checks

#	Criterion	How Verified	Result	Evidence
1	CI pipeline green for merge commit	Woodpecker pipeline #234 (push/main)	PASS	Pipeline #234 status=success. Steps: clone (success), apply (success), cross-pillar-review (success).
2	tofu apply succeeds	Pipeline #234 apply step logs	PASS	Apply complete! Resources: 0 added, 3 changed, 0 destroyed. (3 changes were unrelated ArgoCD label drift on mdview/gcal-scheduler.)
3	Terraform code wires login_theme and verify_email to keycloak_realm	Read keycloak.tf lines 35-36; variables.tf lines 144, 149	PASS	<code>login_theme = each.value.login_theme</code> and <code>verify_email = each.value.verify_email</code> on <code>keycloak_realm.this</code>. Variable type: <code>optional(string)</code> and <code>optional(bool, false)</code>.
4	Example tfvars includes ISS realm with login_theme and verify_email	Read k3s.tfvars.example lines 88-104	PASS	ISS realm block has <code>verify_email = true</code> (line 93) and <code>login_theme = "iss"</code> (line 94).
5	ISS Keycloak theme files deployed (platform#541 dependency)	<code>kubectl exec -n keycloak deploy/keycloak -- find /opt/keycloak/themes/iss -type f</code>	PASS	Theme files present: <code>theme.properties</code>, <code>resources/css/login.css</code>, <code>resources/img/logo.svg</code>. Deployed 2026-07-17 18:05.
6	ISS realm login_theme = "iss" in Keycloak	Keycloak Admin API: <code>GET /admin/realms/iss</code>	FAIL	<code>loginTheme: (default)</code> — not set. The CI apply showed zero Keycloak realm changes, meaning the Woodpecker <code>TFVARS_CONTENT</code> secret does not include <code>login_theme = "iss"</code> for the ISS realm.
7	ISS realm verify_email = true in Keycloak	Keycloak Admin API: <code>GET /admin/realms/iss</code>	FAIL	<code>verifyEmail: False</code>. Same root cause — <code>TFVARS_CONTENT</code> secret not updated.

Root Cause Analysis

PR #187 correctly updates the terraform code and example tfvars to support login_theme and verify_email on the ISS realm. However, the actual CI secret TFVARS_CONTENT (base64-encoded, stored in Woodpecker) has not been updated to include these values. The CI tofu apply ran with the old secret, so the Keycloak realm config was unchanged.

Action required: Update the Woodpecker TFVARS_CONTENT secret for pal-e-services to include login_theme = "iss" and verify_email = true in the ISS realm block, then trigger a manual pipeline run (or push) to apply.

Regression Check

Keycloak pod: Running, 0 restarts (age: 39m)
ISS pod: Running, 0 restarts (age: 6h17m)
Other realm themes unaffected: westside-basketball still has theme=westside, landscaping has theme=landscaping
ISS app root: HTTP 200
ISS realm general config: enabled=True, registrationAllowed=True, SMTP configured via Postmark, bruteForceProtected=True

Discovered Issues

TFVARS_CONTENT secret out of sync. The Woodpecker CI secret for pal-e-services does not include the login_theme and verify_email fields for the ISS realm. This is the blocking issue. Lucas needs to update the secret manually via the Woodpecker UI, then trigger a pipeline.