fix(keycloak): the reconciler could not read its own Secret

Shipped in the previous delivery and failing on every run since:

  FATAL: cannot read /etc/keycloak-realm-clients (PermissionError)
  BackoffLimitExceeded

The client-secrets volume used defaultMode 0400 — owner-only — but the owner of a
projected Secret volume is root, while the pod runs runAsUser/runAsGroup 65532.
The sibling script volume worked only because it is 0444. So the healer that
exists to correct client-secret drift was itself inert.

It failed CLOSED (no writes attempted, no drift introduced), and the two alerts
shipped alongside it are exactly what surfaces this: KeycloakClientSecretReconciler
Failing fires on the failed Jobs. The observability caught its own subject.

Fixed with fsGroup 65532 + defaultMode 0440 rather than relaxing to world-readable
0444: fsGroup makes the projected volume group-owned by the running user, so the
secret stays unreadable to any other uid in the container.

Co-Authored-By: Claude Opus 5 <[email protected]>

platform/keycloak/client-secret-reconciler.yaml

@@ -649,6 +649,12 @@ spec:
             runAsNonRoot: true
             runAsUser: 65532
             runAsGroup: 65532
+            # fsGroup makes the projected Secret volume GROUP-owned by 65532. Without it the
+            # files are owned by root and mode 0400 (owner-only) is unreadable to runAsUser
+            # 65532 — the container died with "cannot read /etc/keycloak-realm-clients
+            # (PermissionError)" on every run. fsGroup + 0440 keeps the secret unreadable to
+            # other users rather than relaxing it to world-readable 0444.
+            fsGroup: 65532
             seccompProfile:
               type: RuntimeDefault
           containers:
@@ -717,4 +723,7 @@ spec:
             - name: client-secrets
               secret:
                 secretName: keycloak-realm-clients
-                defaultMode: 0400
+                # 0440 (not 0400): readable by fsGroup 65532, which the pod securityContext
+                # sets. 0400 is owner-only and the owner is root, not the 65532 the container
+                # runs as. See the fsGroup comment above.
+                defaultMode: 0440