kevinveenbirkenbachandClaude Opus 5 e9f75c43c7 fix(web-app-keycloak): re-login after reschedule ...

kcadm keeps its session inside the container, so a swarm task that gets rescheduled comes back unauthenticated. The cross-node rescue re-resolved the node but never logged in again, so all five recovery attempts died with "No server specified" -- the recovery path could not recover, by construction. Observed in CI run 32119014832 on FusionDirectory#0 and Fediwall#2 with an identical signature; a planned replacement survives today only because the realm import re-includes login.yml right after it.

Reuse utils/login.yml for the recovery leg: it already performs the same resolve and additionally re-authenticates and waits for health.

Drop the health=healthy filter on the login resolve. It contradicted the wait-for-healthy task right after it: with no healthy container the lookup returned an empty id, and inspecting an empty id can never report healthy, turning that wait into a 300s dead end whose empty-but-defined fact also defeats the default() in vars/main.yml. It also let login target a different container than the one updates.yml resolves unfiltered a moment later. aa6e156a6 relaxed the sibling resolver to status=running for the same reason.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-18 23:28:15 +02:00

..

login_bootstrap_admin.yml

…

login.yml

fix(web-app-keycloak): re-login after reschedule

2026-08-18 23:28:15 +02:00