feat(prod): disable keycloak config-cli + bump image to dev's build - #83
Merged
Conversation
Two coupled changes for the GUI-managed prod Keycloak: - Remove 40-config-cli.yaml + 45-keycloak-config-configmap.yaml from the kustomization so the declarative config import never runs again. Prod Keycloak is GUI-managed (team decision 2026-07-22); a config-cli re-run would overwrite admin-console edits. Both files stay in the repo (dormant) so declarative management can be restored if needed. - Bump the Keycloak image sha-b08ab09 (2026-06-17) -> sha-e2b6218 (2026-07-22), matching what dev runs and has been tested on. With config-cli gone from the manifest, ArgoCD can sync this normally: the new image rolls without triggering a config import, so GUI edits survive. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Disables the production Keycloak config import Job (config-cli) to prevent ArgoCD syncs from overwriting GUI-managed configuration, and bumps the prod Keycloak image to the dev-tested build.
Changes:
- Remove
40-config-cli.yamland45-keycloak-config-configmap.yamlfrom the prod Keycloak kustomization resources. - Update the prod Keycloak Deployment image from
sha-b08ab09tosha-e2b6218.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| k8s/app-manifest-prod/j26-keycloak-scoutid/kustomization.yaml | Stops deploying config-cli (and its ConfigMap) and documents the rationale for GUI-managed prod Keycloak. |
| k8s/app-manifest-prod/j26-keycloak-scoutid/20-keycloak.yaml | Bumps the prod Keycloak container image to the dev-tested SHA. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two coupled changes for the GUI-managed prod Keycloak.
1. Permanently disable config-cli
Removes
40-config-cli.yaml+45-keycloak-config-configmap.yamlfrom the kustomization so the declarative config import never runs again. Prod Keycloak is GUI-managed (team decision 2026-07-22) — a config-cli re-run would overwrite admin-console edits. Both files stay in the repo (dormant) so declarative management can be restored if we ever revert.This is the durable, git-based version of the 2026-07-22 cluster-level auto-sync suspend (which didn't persist). After this merges, the "don't manually sync
j26-keycloak-scoutid-prod" caveat goes away — there's no config-cli hook left to fire.2. Bump the Keycloak image to dev's tested build
scoutid-keycloak:sha-b08ab09(2026-06-17) →sha-e2b6218(2026-07-22) — the image dev runs and has been tested on. Verified pullable.Why they're in one PR
With config-cli gone from the manifest, ArgoCD can sync this normally: the new image rolls without triggering a config import, so GUI edits survive. Doing the image bump alone (with config-cli still present) would re-run the import on sync.
On merge
prune: truedeletes the now-undeclaredkeycloak-configConfigMap fromj26-prod(harmless — nothing consumes it once the Job is gone).Renders clean (no config-cli Job/ConfigMap in output), server-side
--dry-runpasses.🤖 Generated with Claude Code