From bc9c93d2abedfa295fb35674e59b6a7db49618a0 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 7 Sep 2026 02:07:28 -0500 Subject: [PATCH] fix(keycloak): the reconciler could not read its own Secret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Shipped in the previous delivery and failing on every run since: FATAL: cannot read /etc/keycloak-realm-clients (PermissionError) BackoffLimitExceeded The client-secrets volume used defaultMode 0400 — owner-only — but the owner of a projected Secret volume is root, while the pod runs runAsUser/runAsGroup 65532. The sibling script volume worked only because it is 0444. So the healer that exists to correct client-secret drift was itself inert. It failed CLOSED (no writes attempted, no drift introduced), and the two alerts shipped alongside it are exactly what surfaces this: KeycloakClientSecretReconciler Failing fires on the failed Jobs. The observability caught its own subject. Fixed with fsGroup 65532 + defaultMode 0440 rather than relaxing to world-readable 0444: fsGroup makes the projected volume group-owned by the running user, so the secret stays unreadable to any other uid in the container. Co-Authored-By: Claude Opus 5 --- platform/keycloak/client-secret-reconciler.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/platform/keycloak/client-secret-reconciler.yaml b/platform/keycloak/client-secret-reconciler.yaml index 5047110..0d231d7 100644 --- a/platform/keycloak/client-secret-reconciler.yaml +++ b/platform/keycloak/client-secret-reconciler.yaml @@ -649,6 +649,12 @@ spec: runAsNonRoot: true runAsUser: 65532 runAsGroup: 65532 + # fsGroup makes the projected Secret volume GROUP-owned by 65532. Without it the + # files are owned by root and mode 0400 (owner-only) is unreadable to runAsUser + # 65532 — the container died with "cannot read /etc/keycloak-realm-clients + # (PermissionError)" on every run. fsGroup + 0440 keeps the secret unreadable to + # other users rather than relaxing it to world-readable 0444. + fsGroup: 65532 seccompProfile: type: RuntimeDefault containers: @@ -717,4 +723,7 @@ spec: - name: client-secrets secret: secretName: keycloak-realm-clients - defaultMode: 0400 + # 0440 (not 0400): readable by fsGroup 65532, which the pod securityContext + # sets. 0400 is owner-only and the owner is root, not the 65532 the container + # runs as. See the fsGroup comment above. + defaultMode: 0440