From 6b93ebd0ef8ff60075428604364374b1f91c804f Mon Sep 17 00:00:00 2001
From: Codex <codex@pikastech.local>
Date: Thu, 4 Jun 2026 04:21:31 +0800
Subject: [PATCH] fix(k8s): keycloak admin bootstrap Job - simpler mount and
 script

---
 .../k8s/keycloak/keycloak-bootstrap-job.yaml  | 145 ++++++++++--------
 deploy/k8s/keycloak/keycloak.yaml             |   5 +-
 2 files changed, 84 insertions(+), 66 deletions(-)

diff --git a/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml b/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml
index f8473960..63b03911 100644
--- a/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml
+++ b/deploy/k8s/keycloak/keycloak-bootstrap-job.yaml
@@ -1,67 +1,3 @@
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: keycloak-bootstrap-realm
-  namespace: keycloak
-  labels:
-    app.kubernetes.io/name: keycloak-bootstrap-realm
-    hwlab.pikastech.local/component: identity
-spec:
-  backoffLimit: 5
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: keycloak-bootstrap-realm
-        hwlab.pikastech.local/component: identity
-    spec:
-      restartPolicy: OnFailure
-      containers:
-        - name: bootstrap
-          image: curlimages/curl:8.10.1
-          command:
-            - /bin/sh
-            - -ceu
-            - |
-              set -eu
-              KC=http://keycloak.keycloak.svc.cluster.local:8080
-              until curl -sf $KC/health/ready > /dev/null; do
-                echo waiting-for-keycloak; sleep 5
-              done
-              ADMIN_USER=admin
-              ADMIN_PASSWORD=$(cat /tmp/admin-password)
-              CLIENT_ID=hwlab-cloud-web
-              CLIENT_SECRET=$(cat /tmp/client-secret)
-              REALM=hwlab
-              until TOKEN=$(curl -sf -X POST "$KC/realms/master/protocol/openid-connect/token" -H "content-type: application/x-www-form-urlencoded" -d "username=$ADMIN_USER&password=$ADMIN_PASSWORD&grant_type=password&client_id=admin-cli" | sed -n '"'"'s/.*"access_token":"\([^"]*\)".*/\1/p'"'"'); do
-                echo waiting-for-admin-cli; sleep 5
-              done
-              if curl -sf -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM > /dev/null; then
-                echo realm-already-exists; exit 0
-              fi
-              curl -sf -X POST $KC/admin/realms -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -d "{\"realm\":\"$REALM\",\"enabled\":true,\"registrationAllowed\":true,\"verifyEmail\":false,\"loginWithEmailAllowed\":true,\"duplicateEmailsAllowed\":false,\"resetPasswordAllowed\":false,\"editUsernameAllowed\":false,\"bruteForceProtected\":false,\"accessTokenLifespan\":1440,\"ssoSessionIdleTimeout\":86400,\"ssoSessionMaxLifespan\":86400}"
-              echo realm-created
-              curl -sf -X POST $KC/admin/realms/$REALM/clients -H "Authorization: Bearer $TOKEN" -H "content-type: application/json" -d "{\"clientId\":\"$CLIENT_ID\",\"secret\":\"$CLIENT_SECRET\",\"redirectUris\":[\"http://74.48.78.17:19667/auth/oidc/callback\",\"https://auth.74-48-78-17.nip.io/auth/oidc/callback\"],\"webOrigins\":[\"+\"],\"standardFlowEnabled\":true,\"directAccessGrantsEnabled\":true}"
-              echo client-created
-          env:
-            - name: KC_BOOTSTRAP_ADMIN_USERNAME
-              value: admin
-          volumeMounts:
-            - name: admin-password
-              mountPath: /tmp/admin-password
-              subPath: password
-              readOnly: true
-            - name: client-secret
-              mountPath: /tmp/client-secret
-              subPath: client-secret
-              readOnly: true
-      volumes:
-        - name: admin-password
-          secret:
-            secretName: keycloak-admin
-        - name: client-secret
-          secret:
-            secretName: hwlab-cloud-web-client
----
 apiVersion: v1
 kind: Secret
 metadata:
@@ -73,3 +9,84 @@ metadata:
 type: Opaque
 stringData:
   client-secret: kc-client-secret-placeholder
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: keycloak-bootstrap-realm
+  namespace: keycloak
+  labels:
+    app.kubernetes.io/name: keycloak-bootstrap-realm
+    hwlab.pikastech.local/component: identity
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: keycloak-bootstrap-realm
+        hwlab.pikastech.local/component: identity
+    spec:
+      restartPolicy: OnFailure
+      containers:
+        - name: bootstrap
+          image: curlimages/curl:8.10.1
+          env:
+            - name: ADMIN_PASSWORD_FILE
+              value: /tmp/admin-password
+            - name: CLIENT_SECRET_FILE
+              value: /tmp/client-secret
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -eu
+              KC=http://keycloak.keycloak.svc.cluster.local:8080
+              until curl -sf $KC/realms/master > /dev/null; do
+                echo waiting-for-keycloak
+                sleep 5
+              done
+              ADMIN_PASSWORD=$(cat /tmp/admin-password/password)
+              CLIENT_SECRET=$(cat /tmp/client-secret/client-secret)
+              REALM=hwlab
+              curl -sf -X POST $KC/realms/master/protocol/openid-connect/token \
+                -H 'content-type: application/x-www-form-urlencoded' \
+                --data-urlencode 'username=admin' \
+                --data-urlencode "password=$ADMIN_PASSWORD" \
+                --data-urlencode 'grant_type=password' \
+                --data-urlencode 'client_id=admin-cli' \
+                > /tmp/token.json
+              cat /tmp/token.json
+              TOKEN=$(grep -oE 'access_token":"[^"]+' /tmp/token.json | head -1 | cut -d'"' -f3)
+              if [ -z "$TOKEN" ]; then
+                echo no-token
+                exit 1
+              fi
+              if curl -sf -H "Authorization: Bearer $TOKEN" $KC/admin/realms/$REALM > /dev/null; then
+                echo realm-already-exists
+                exit 0
+              fi
+              echo creating-realm
+              curl -sf -X POST $KC/admin/realms \
+                -H "Authorization: Bearer $TOKEN" \
+                -H 'content-type: application/json' \
+                -d '{"realm":"hwlab","enabled":true,"registrationAllowed":true,"verifyEmail":false,"loginWithEmailAllowed":true,"duplicateEmailsAllowed":false,"resetPasswordAllowed":false,"editUsernameAllowed":false,"bruteForceProtected":false,"accessTokenLifespan":1440,"ssoSessionIdleTimeout":86400,"ssoSessionMaxLifespan":86400}'
+              echo realm-created
+              curl -sf -X POST $KC/admin/realms/$REALM/clients \
+                -H "Authorization: Bearer $TOKEN" \
+                -H 'content-type: application/json' \
+                -d '{"clientId":"hwlab-cloud-web","secret":"'"$CLIENT_SECRET"'","redirectUris":["http://74.48.78.17:19667/auth/oidc/callback","https://auth.74-48-78-17.nip.io/auth/oidc/callback"],"webOrigins":["+"],"standardFlowEnabled":true,"directAccessGrantsEnabled":true}'
+              echo client-created
+          volumeMounts:
+            - name: admin-password
+              mountPath: /tmp/admin-password
+              readOnly: true
+            - name: client-secret
+              mountPath: /tmp/client-secret
+              readOnly: true
+      volumes:
+        - name: admin-password
+          secret:
+            secretName: keycloak-admin
+        - name: client-secret
+          secret:
+            secretName: hwlab-cloud-web-client
diff --git a/deploy/k8s/keycloak/keycloak.yaml b/deploy/k8s/keycloak/keycloak.yaml
index 6d8a8abc..45562c3e 100644
--- a/deploy/k8s/keycloak/keycloak.yaml
+++ b/deploy/k8s/keycloak/keycloak.yaml
@@ -17,6 +17,9 @@ items:
         - name: http
           port: 8080
           targetPort: http
+        - name: management
+          port: 9000
+          targetPort: management
   - apiVersion: apps/v1
     kind: Deployment
     metadata:
@@ -51,8 +54,6 @@ items:
                 - --db=postgres
                 - --db-url=jdbc:postgresql://keycloak-postgres.keycloak.svc.cluster.local:5432/keycloak
                 - --db-username=keycloak
-                - --bootstrap-admin-username=admin
-                - --bootstrap-admin-password=kc-admin-dev-password
                 - --health-enabled=true
               ports:
                 - name: http