fix: sync prod keycloak realm with dev (cms/reports clients + admin groups) - #73
Merged
Conversation
…roups) Regenerated from the j26-keycloak source repo (bd0ffbe). Additions only, no removals: - New role-container clients j26-cms and j26-reports (JWT-verify only, no secret/flows) + their client roles (cms: editor/admin, reports: diet:read). - Four hand-managed admin groups (j26-checkin-admin, j26-cms-manager, j26-platsbank-admin, j26-reports), top-level siblings of j26-scoutid-sync. - Expanded group->client-role assignments in 05-group-roles.yaml (staff/planning-staff/leader booking+platsbank roles; admin groups). Tested against a fresh config-cli import in j26-prod (via an unmanaged test ConfigMap, since ArgoCD auto-reverts a manual apply of the live one): imports clean 00-05, both new clients + all 4 admin groups created, role assignments attach, and the sync-owned subtree is untouched (kår 577 / villages 242 / districts 5). Auth works. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the production Keycloak realm configuration ConfigMap for j26-keycloak-scoutid to match the regenerated dev-aligned export (from j26-keycloak commit bd0ffbe), adding new role-container clients, roles, and hand-managed admin groups intended for production use.
Changes:
- Added standalone (non-sync-owned) admin groups (
j26-checkin-admin,j26-cms-manager,j26-platsbank-admin,j26-reports) to the declared group structure and role-assignment declarations. - Added role-container clients
j26-cmsandj26-reports, plus their corresponding client roles. - Expanded group → client-role assignments for existing synced groups (staff/planning-staff/leader) to include booking/platsbank roles.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Address Copilot on #73: the comment said 01-realm.yaml declares ONLY the /j26-scoutid-sync parent group, but this PR also adds the standalone admin groups there. Reworded to cover both, so the no-delete pruning rationale stays accurate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
hakan-persson
requested review from
Anna-Qvil,
m4reko and
scriptcoded
and removed request for
Anna-Qvil,
m4reko and
scriptcoded
July 22, 2026 14:48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copies the regenerated
45-keycloak-config-configmap.yamlfrom thej26-keycloaksource repo (commitbd0ffbe) into the prod manifests. Brings the prod realm in line with dev (id.dev.j26.se). Additions only — no removals.What it adds
j26-cms,j26-reports(JWT-verify only, no secret/flows, likej26-signupinfo).j26-cms: editor, admin;j26-reports: diet:read.j26-checkin-admin,j26-cms-manager,j26-platsbank-admin,j26-reports(top-level siblings ofj26-scoutid-sync, not sync-owned).05-group-roles.yaml— staff/planning-staff/leader gain booking + platsbank (+ signupinfo) roles; the admin groups carry elevated roles.Tested in j26-prod
Verified against a fresh config-cli import (run via an unmanaged test ConfigMap — a manual apply of the live one is auto-reverted by ArgoCD, since
j26-keycloak-scoutid-prodhasautomated: true):j26-cms-manager → j26-cms: editor, admin).05group re-declaration +IMPORT_MANAGED_GROUP=no-deletedid not prune).Because of
automated: true, prod picks this up only when this merges — there is no manual live bridge this time.🤖 Generated with Claude Code