From 9781102e2971d762ae42fdd5085a6647afd1cd66 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 1 Sep 2026 00:03:08 +0200 Subject: [PATCH] Deploy KeyCape canonical subject fix Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a058f3-8ba0-7692-a042-9a870fc3d663 --- sso-mfa/k8s/keycape/deployment.yaml | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/sso-mfa/k8s/keycape/deployment.yaml b/sso-mfa/k8s/keycape/deployment.yaml index f4cbba8..db88062 100644 --- a/sso-mfa/k8s/keycape/deployment.yaml +++ b/sso-mfa/k8s/keycape/deployment.yaml @@ -15,9 +15,8 @@ # 4. middleware.yaml + ingress.yaml # # Container image: -# KeyCape has no published image. Build from ~/key-cape/ and push to a registry, -# or import directly into K3s (see README.md "Building the image"). -# Image tag below is a placeholder — update before applying. +# KeyCape publishes immutable main- tags through Forgejo Actions. +# K3s pulls through the HTTPS Forgejo registry origin. apiVersion: apps/v1 kind: Deployment @@ -49,12 +48,9 @@ spec: containers: - name: keycape - # Image published to self-hosted Gitea OCI registry on CoulombCore (KEY-WP-0002). - # k3s insecure registry configured for 92.205.130.254:32166 — no pull secret needed. - # 2026-05-24: direct-imported into railiance01 k3s for the - # bootstrap-console OIDC/MFA rollout. Use IfNotPresent while the - # HTTP registry push/pull path is being cleaned up. - image: key-cape:mfa-client-20260809 + # Image published to the self-hosted Forgejo OCI registry (KEY-WP-0002). + # KEY-WP-0012: canonical OIDC subject resolution for /userinfo. + image: forgejo.coulomb.social/coulomb/key-cape:main-153258b imagePullPolicy: IfNotPresent ports: