mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 03:15:56 +00:00
kevinveenbirkenbachandClaude Opus 5.5
9301220d05
The per-app RBAC groups and LDAP group mappers were reconciled by four kcadm shell scripts that started a JVM per call and re-synced every app on every deploy: 582 s for the mappers plus 324 s for the orphan purge on echoserver (39 apps). rbac_reconcile.py now talks to the admin REST API from inside the Keycloak network namespace (nsenter --net) with the admin credentials read from /proc/<pid>/environ, so nothing secret reaches argv or output. It drops the shared ldap-roles mapper, purges root groups of undeployed apps, ensures each app group and mapper, and syncs a mapper only when the group is new, the mapper config drifted, or the fingerprint stored on the group (mapper payload, app rbac and domains, group-logic digest) differs. The per-app payload no longer carries groups.path.group: Keycloak 26.8.1 does not store that key, so a payload with it never matched the stored mapper and every deploy re-synced every app. The admin client lives in keycloak_admin.py; tasks/utils/rest_script.yml stages it with the script in a 0700 temp dir on KEYCLOAK_HOST_NODE, runs it and removes the dir in an always block. Evidence (local compose, slot 104): matrix iteration green in both variants and passes; update runs show synced=1 in 1.1 s, then synced=0 unchanged=1 in 0.81 s through the final delivery path, no staging dir left behind. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>