Retire the Keycloak bootstrap (temporary) admin in prod

[hakan-persson]

Background

The prod ScoutID Keycloak (j26-prod) uses a Keycloak 26 bootstrap admin (KC_BOOTSTRAP_ADMIN_USERNAME/_PASSWORD, materialized from KV via the CSI driver and set on the Deployment in 20-keycloak.yaml). The Keycloak admin UI shows the standard "temporary admin user" warning while this exists.

55-ensure-master-admin-job.yaml already creates a permanent master-realm admin (j26-keycloak-admin), so the recommended remediation ("create a permanent admin, then remove the temporary one") is half-done.

Why this isn't a one-liner

The bootstrap admin is currently the credential that two Jobs authenticate with, so it cannot simply be removed:

Job	Hook	Auths as
keycloak-config (config-cli)	Sync (every ArgoCD sync)	KC_BOOTSTRAP_ADMIN_*
ensure-master-admin	PostSync	KC_BOOTSTRAP_ADMIN_*

Removing the bootstrap admin without repointing these would break the entire Keycloak GitOps loop (the config-cli import that applies the realm config runs as bootstrap on every sync).

Proposed steps (sequenced)

1. Repoint keycloak-config's KEYCLOAK_USER/KEYCLOAK_PASSWORD at the permanent j26-keycloak-admin (the MASTER_ADMIN_* secret keys) instead of the bootstrap keys.
2. Decide what to do with ensure-master-admin — it becomes circular once it authenticates as the user it ensures; either keep it bootstrap-authed or retire the Job once the permanent admin is proven stable.
3. Once nothing uses bootstrap: remove KC_BOOTSTRAP_ADMIN_* from the Deployment and delete the temporary admin user (small kcadm step) → the UI warning clears.

Notes

• Sequencing-sensitive: a wrong order can lock out admin access or break config sync. Validate against a non-prod realm first if possible.
• Surfaced in review of feat(prod): deploy ScoutID Keycloak to production #28 (scriptcoded). Deferred out of that hostname/config PR.