recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(keycloak): collision-free canonical domain for live-warm providers; enroll keycloak

Browse Source 
canonical_domain() routes any recipe in warm.WARM_DOMAINS (keycloak) to a distinct warm-canon-<recipe>
domain so the data-warm canonical promote can never collide with the live-warm OIDC provider at
warm-keycloak. keycloak WARM_CANONICAL=True (full canonical coverage without risking live SSO).
This commit is contained in:
autonomic-bot
2026-06-18 01:58:16 +00:00
parent c742f9adc4
commit 61211dba70
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
runner/harness/canonical.py
View File

@ -40,7 +40,17 @@ def is_enrolled(recipe: str) -> bool:
def canonical_domain(recipe: str) -> str:
"""Stable data-warm domain for the recipe's canonical."""
"""Stable data-warm domain for the recipe's canonical.
For a recipe that is ALSO a live-warm provider (in `warm.WARM_DOMAINS` — e.g. keycloak, whose
always-on shared OIDC instance lives at `warm-keycloak…`), the data-warm canonical MUST use a
DISTINCT domain: otherwise the sweep's promote deploy/teardown at `warm-<recipe>` collides with —
and could disrupt — the live shared service that other recipes (lasuite-*/drone) depend on. Give
those recipes a collision-free `warm-canon-<recipe>` namespace (a separate stack/domain that can
never touch the live provider); every other recipe keeps the plain `warm-<recipe>` scheme
(zero blast radius on the 15 existing canonicals)."""
if recipe in warm.WARM_DOMAINS:
return f"warm-canon-{recipe}.ci.commoninternet.net"
return warm.stable_domain(recipe)