8 Commits

Author	SHA1	Message	Date
Codex Agent	e64ee92fb1	fix(v0.2): align Keycloak auth to HTTPS session API key	2026-06-04 15:01:30 +08:00
Codex Agent	e70dab1f88	fix(v02): wire Keycloak OIDC runtime	2026-06-04 15:01:30 +08:00
Codex Agent	36b264f212	fix(keycloak): use supported admin bootstrap env	2026-06-04 15:01:30 +08:00
Codex	4d48db9e7c	feat(hwlab-cli): client auth oidc-login returns Keycloak authorize URL	2026-06-04 15:01:30 +08:00
Codex	6b93ebd0ef	fix(k8s): keycloak admin bootstrap Job - simpler mount and script	2026-06-04 15:01:30 +08:00
Codex	0370135a35	feat(k8s+tests): keycloak bootstrap Job + AgentRun actor trace tests ... - new deploy/k8s/keycloak/keycloak-bootstrap-job.yaml: one-shot Job that waits for Keycloak, authenticates as admin, creates hwlab realm + hwlab-cloud-web OIDC client via REST API - secret hwlab-cloud-web-client holds the OIDC client_secret used by cloud-api - kustomization.yaml picks up the new Job and Secret - access-control.test.ts: cloud api AgentRun trace records real actor.userId from OIDC-upserted user (issue 788 spec) - access-control.test.ts: cloud api /v1/users/me returns actor with authMethod=api-key for HWLAB_API_KEY Bearer token - 31 pass / 4 pre-existing fail	2026-06-04 15:01:30 +08:00
Codex	1ba5103d33	fix(k8s): add --bootstrap-admin-username/password CLI args to keycloak	2026-06-04 15:01:30 +08:00
Codex	ca5ff418dd	feat(k8s): keycloak namespace manifests + apply on G14 ... - new deploy/k8s/keycloak/ kustomization with namespace, keycloak-postgres StatefulSet, keycloak Deployment - keycloak Deployment uses quay.io/keycloak/keycloak:25.0 with --hostname-strict=false, postgres backend - PVC data-keycloak-postgres-0 (5Gi local-path) bound to the StatefulSet - secrets keycloak-postgres / keycloak-admin provisioned in keycloak namespace - OIDC discovery endpoint confirmed reachable via port-forward; master realm issuer http://.../realms/master - next round will provision the hwlab realm + OIDC client	2026-06-04 15:01:30 +08:00