feat(keycloak): audience mapper for forte-drop-mcp on forte-cli (fallback)

Adds an oidc-audience-mapper to the forte-cli client so its access tokens carry aud=https://mcp.drop.forteapps.net/mcp, the audience the forte-drop-mcp auth sidecar verifies. Fallback for the case where Keycloak ignores the RFC 8707 resource= parameter the skill sends. Stacks on #26. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add forte-cli public device-code Keycloak client
2026-09-28 11:11:36 +02:00 · 2026-09-03 09:56:31 +02:00
28 changed files with 54 additions and 142 deletions
@@ -23,15 +23,14 @@ jobs:
      REVIEW__INLINE_COMMENT_FALLBACK: "false"
      # LLM configuration
      LLM__PROVIDER: CLAUDE
-      LLM__META__MODEL: claude-sonnet-5-5
-      LLM__META__REASONING__EFFORT: high
+      LLM__META__MODEL: claude-3-opus
      LLM__META__MAX_TOKENS: "4096"
      LLM__HTTP_CLIENT__API_URL: https://api.anthropic.com
      LLM__HTTP_CLIENT__API_TOKEN: ${{ secrets.ANTHROPIC_API_KEY }}

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v4
      with:
        submodules: true
        fetch-depth: 0
@@ -41,11 +40,11 @@ jobs:
      run: git submodule update --remote --merge

    - name: Run inline review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
        args: ai-review run-inline

    - name: Run summary review
-      uses: docker://nikitafilonov/ai-review:v1.1.0
+      uses: docker://nikitafilonov/ai-review:v0.64.0
      with:
        args: ai-review run-summary
@@ -9,7 +9,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name: Install TruffleHog
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
-      version = "~> 8.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
-      version = "~> 8.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
-      version = "~> 8.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
-      version = "~> 8.0"
+      version = "~> 6.0"
    }
  }
 }
@@ -7,8 +7,7 @@ metadata:
  namespace: mcp10x
 spec:
  encryptedData:
-    BENKEN_CLIENT_SECRET: AgBjps8BCn20C8upAaAdb1fG4Qh3eKBbTeFuuWhQb8WoIvHmk+v03mw8i39evkQwlUWvLBWV1mtGiKwpCNhmAAdicRFG6u0m30+21K6ZtYqtKEniPKo/kjPd9nDbtxvIwiaqKs+kvFpqbxKaeqF5THYNxHZBg8gGeSbAkSx+BNIY2iLm8NRBzgC5FME5jbX8pet+DN7tbmsQTtG5f1q+h24aKXjvN5SigPft1BetfleHGlus0hFXpJ7zS4rV7rpSKSiLVV/KtS5YqEDj9uunZKyGT8j93z5xQbj0bCPVF3TU5+RCL6eE/GSgJxM4ePZ2gWZRG4eHDlGK2qE+JaNIng8wWycqLVrbs1kWoP2cdRGq6b8GHwoplAM4h4ud2fac6+5V4alhy8uhRTAX7dUG3UkwOQV/hTRb97pctPwQfltkBpDBhhW3Lfy9whSdqBuD9OqhegTqxCuWXr/P4KVOORUr0V0Iex45oLMqivI3FB2rTq9Lkwpf5YKE14d7RbKWF1G28FCNAcV8vnOIslkztLuu3GgQbVIoIiZGnnYEPofjUxbDZ/Sd1LrGeHEPR+/JJnNhNxv2297UuIIEC8kfiKuwjtLOMVQg51UbESx/+d1XmgLPqkz+jAqEPxvu8u5wO0Dov6vliTbtewJf8+fet3xnFNvyuY5ymmiTla6Gm9XPJscLj5iCzT3VhA/QuhhWXinmE/UnpYP0U4YPl5B/dUA9qT95BA6GBpDXPrDJRWNfpAH1wfG70lEBuBQXgdixYlwvx2JO6OI5+ztBKO0qFkgK
-    FLOWCASE_TOKEN: AgBLN1BWnFs3R2K+Wvb37ABucQWvx8mVVDEhZiIOYYLE8SDdbshxluP4J4IISmHwLX7Q0gYWeypfTCfvMa9c5b9AEjTcpodv4CMhjp5Mq7zUCtTI6pH6QZgLhjGheKCY+RciIK1DBsNk7CZa9MuVUdd1w0/m2C7fwikPPvNDHcNLR7zBBPWVlprgRyMrsdykcm7cmWcyqTwa/55DVPPJsG9x1K2YnjzgWHlX7BoLB/Nx7qX4XVadKEXnV0jVO5isalARxvke32pwebaiFSg8EZMhe4lntOqMSP26y/9RbveeEZS8qxzoR2OmsVrHUpMeppzpVkvQ9sKi2B4Vx8XoiRY6hZR+TmZKTvFa6JKx9gwAOVs53LEUaF7+uOQOrIcFyOXm7Ibj/azf7opqfvGajygRzSUaffTIixj+M5eJnm/iua/BWarW2w4c+ZIKvQ9DhcYpnF9Gj0U7+EWfNZyzlMoLRHsOIyKNUhOeEaSLoVQGyqRY72ZGqs83EPfQYlEu74PGyXPjd11KMhAayluGLadeAH2QDyigpf7REdXAGULNDhkJrqeYMmmGCZCyrvNOoXjYC4jQQEYA4Sd4QJA05q/EW8aFE/++nY8RqhbHqDz6wshAW/WFsTsR4JC6fc5qR+YVSmjKOa7lnk7I9vD7uPEZzCc6ImvA/NxTCfDKCREvLA5G0lYsmiTuxYmBesUgCSVVMxflEl1GXvGpFniZKPyvxIdna9j7XEQjUZsGTiyN1w==
+    FLOWCASE_TOKEN: AgAjQ0Jm779LiB2/EBKtIl18Iky/tgl7VvEvkJfr82mbe7JIp99+I8WPIMgmlXsxWBDfwJ/DZoDEAKG5o8mvwc7DtaE7LkpPSXKRIviLrm+7amNdEpwb1zKjCmZ3vNOPXLnCTD3W1od8u106MEvrZpt1N1Pzav/QUElAA4lqyf4AZPuio0H/7jF8QciVHIN4BdofodOmWWCTxP1aVMylat3txlkzuqwkXc1fKBPmOKC1qWepAG7dlQ3xJ2C5Cinz5IqOYnQPO6sm/Gp+c8yQSS+0NpKO3dp93yuwRsOLOMNpCeeYOyzn2ypFIdiBuLA5k85l5WyI9BCvRjP+kzRX+u69XL7p2eMEg+vRVfoOWNetysYCdK+96bWNVVleQEuPAFxsbJWK5eV8jTZk+QeFES8kkXQwUoTMqh+JULgONakxrzc1LmA+FtKNwHWCHalh8pLQ9KeI2i9E5CtotjHfEGLE6T0ibwwOg1ZrL3irQVII8VFm4Rk+dSicbeEMAtIaII023NWuZlonrwIIy+GSVzskhhcjV7t51hylqFA3yfb+RQCzdGYA5fySlJBWhli8IotvqnDmWduPBHGb/+yrdXHsaiDqWuUu6JBUg4JqM+AMa8FkaFh8SbctbGBoycpzLVFn9N2qWviojhC9s1NJ4MiCegvE6IsCLaHidY4UXeeGjUK6Mx6h4x3y/q7ZIrBIpUOJ+8I4Mgvi9sTCogeR+vWtpP9ZZ/31MXELuu/ho3Wn9Q==
  template:
    metadata:
      creationTimestamp: null
@@ -29,7 +29,7 @@ spec:
                  topologyKey: kubernetes.io/hostname
          initContainers:
            - name: gitea-dump
-              image: gitea/gitea:1.27.3
+              image: gitea/gitea:1.25.4
              command:
                - sh
                - -c
@@ -1,27 +1,27 @@
 {
  "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.16.0/.schema/devbox.schema.json",
  "packages": [
-    "kubectl@1.36.3",
-    "kubernetes-helm@4.2.4",
-    "k9s@0.51.0",
-    "kubeseal@0.38.4",
-    "argocd@3.4.6",
-    "kubecm@0.35.1",
-    "kubectl-tree@0.6.0",
-    "kind@0.32.0",
-    "kustomize@5.8.1",
-    "kyverno@1.19.0",
-    "syft@1.51.0",
-    "grype@0.118.0",
-    "traefik@3.7.10",
-    "claude-code@2.1.245",
+    "kubectl@1.33.2",
+    "kubernetes-helm@3.18.4",
+    "k9s@0.50.7",
+    "kubeseal@0.30.0",
+    "argocd@2.14.11",
+    "kubecm@0.33.1",
+    "kubectl-tree@0.4.3",
+    "kind@0.29.0",
+    "kustomize@5.7.0",
+    "kyverno@1.14.3",
+    "syft@1.29.0",
+    "grype@0.92.2",
+    "traefik@3.6.7",
+    "claude-code@latest",
    "go@latest",
-    "dotnet-sdk@8.0.424",
-    "opentofu@1.12.5",
-    "_1password@2.30.0",
-    "github-cli@2.23.0",
-    "upcloud-cli@3.36.0",
-    "awscli2@2.35.11"
+    "dotnet-sdk@latest",
+    "opentofu@1.11.6",
+    "_1password@latest",
+    "github-cli@latest",
+    "upcloud-cli@3.29.0",
+    "awscli2@2.34.24"
  ],
  "shell": {
    "init_hook": [
@@ -17,7 +17,7 @@ spec:
  source:
    repoURL: https://charts.jetstack.io
    chart: cert-manager
-    targetRevision: "v1.21.2"
+    targetRevision: "v1.14.0"

    helm:
      values: |
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://fluent.github.io/helm-charts
    chart: fluent-bit
-    targetRevision: 0.58.2
+    targetRevision: 0.47.10
    helm:
      releaseName: fluent-bit
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://dl.gitea.com/charts
    chart: actions
-    targetRevision: "0.1.2"
+    targetRevision: "0.0.5"
    helm:
      releaseName: gitea-actions
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://dl.gitea.com/charts
    chart: gitea
-    targetRevision: "12.7.0"
+    targetRevision: "12.6.0"
    helm:
      releaseName: gitea
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://grafana.github.io/helm-charts
    chart: grafana
-    targetRevision: "8.15.0"
+    targetRevision: "8.0.0"
    helm:
      releaseName: grafana
      valueFiles:
@@ -36,7 +36,7 @@ spec:
  source:
    chart: kyverno
    repoURL: https://kyverno.github.io/kyverno/
-    targetRevision: 3.9.1
+    targetRevision: v3.7.0 # Update to latest stable version
    helm:
      releaseName: kyverno
      valuesObject:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://grafana.github.io/helm-charts
    chart: loki
-    targetRevision: "7.3.0"
+    targetRevision: "6.0.0"
    helm:
      releaseName: loki
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://opencost.github.io/opencost-helm-chart
    chart: opencost
-    targetRevision: "2.5.32"
+    targetRevision: "1.42.0"
    helm:
      releaseName: opencost
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://prometheus-community.github.io/helm-charts
    chart: prometheus
-    targetRevision: "28.16.0"
+    targetRevision: "28.9.0"
    helm:
      releaseName: prometheus
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: ghcr.io/renovatebot/charts
    chart: renovate
-    targetRevision: "46.318.0"
+    targetRevision: "46.109.0"
    helm:
      releaseName: renovate
      valueFiles:
@@ -16,8 +16,8 @@ spec:

  source:
    chart: sealed-secrets
-    repoURL: https://bitnami.github.io/sealed-secrets
-    targetRevision: 2.20.0
+    repoURL: https://bitnami-labs.github.io/sealed-secrets
+    targetRevision: 2.16.2 # Update to latest stable version
    helm:
      releaseName: sealed-secrets
      parameters:
@@ -24,7 +24,7 @@ spec:
  sources:
  - repoURL: https://traefik.github.io/charts
    chart: traefik
-    targetRevision: "28.3.0"
+    targetRevision: "28.0.0"
    helm:
      releaseName: traefik
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://helm.releases.hashicorp.com
    chart: vault
-    targetRevision: "0.34.1"
+    targetRevision: "0.32.0"
    helm:
      releaseName: vault
      valueFiles:
@@ -17,7 +17,7 @@ spec:
  sources:
  - repoURL: https://guerzon.github.io/vaultwarden
    chart: vaultwarden
-    targetRevision: "0.46.2"
+    targetRevision: "0.36.4"
    helm:
      releaseName: vaultwarden
      valueFiles:
@@ -319,7 +319,6 @@ extraDeploy:
    namespace: keycloak
  spec:
    schedule: "*/2 * * * *"
-    timeZone: "Europe/Oslo"
    concurrencyPolicy: Forbid
    successfulJobsHistoryLimit: 1
    failedJobsHistoryLimit: 3
@@ -332,7 +331,7 @@ extraDeploy:
            restartPolicy: Never
            containers:
            - name: registrar
-              image: alpine:3.24
+              image: alpine:3.20
              command: [ "/bin/sh", "-c" ]
              args:
              - |
@@ -647,9 +646,7 @@ extraDeploy:
    name: keycloak-client-cleanup
    namespace: keycloak
  spec:
-    schedule: "0 3 1 * *"
-    timeZone: "Europe/Oslo"
-    startingDeadlineSeconds: 3600
+    schedule: "0 3 * * 0"
    concurrencyPolicy: Forbid
    successfulJobsHistoryLimit: 1
    failedJobsHistoryLimit: 3
@@ -662,7 +659,7 @@ extraDeploy:
            restartPolicy: Never
            containers:
            - name: cleanup
-              image: alpine:3.24
+              image: alpine:3.20
              command: [ "/bin/sh", "-c" ]
              args:
              - |
@@ -706,18 +703,16 @@ extraDeploy:
                CLIENTS=$(curl -sf -H "Authorization: Bearer ${TOKEN}" \
                  "${KEYCLOAK_URL}/admin/realms/${REALM}/clients")

-                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" \
-                  --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
+                CANDIDATES=$(echo "$CLIENTS" | jq -c --argjson protected "$PROTECTED_JSON" --argjson now "$NOW_SEC" --argjson min_age "$MIN_AGE_SEC" --arg pattern "$CLIENT_ID_PATTERN" '
                  [
                    .[]
                    | select(.clientId as $cid | $protected | index($cid) | not)
                    | select(.attributes["k8s.secret.sync"] != "true")
                    | select(.clientId | test($pattern; "i"))
-                    | select(.attributes["client.secret.creation.time"] != null)
-                    | select((.attributes["client.secret.creation.time"] | tonumber) < ($now - $min_age))
+                    | select((.createdTimestamp // 0) / 1000 < ($now - $min_age))
                  ]
                ')
-                
+
                COUNT=$(echo "$CANDIDATES" | jq 'length')
                echo "Found ${COUNT} candidate client(s) matching pattern and age threshold"

@@ -762,7 +757,7 @@ extraDeploy:
              - name: DRY_RUN
                value: "false"
              - name: MIN_AGE_DAYS
-                value: "60"
+                value: "15"
              volumeMounts:
              - name: keycloak-credentials
                mountPath: /secrets
@@ -17,14 +17,7 @@ loki:
        period: 24h
      object_store: filesystem # we're storing on filesystem so there's no real persistence here.
      schema: v13
-  compactor:
-    working_directory: /var/loki/compactor
-    retention_enabled: true
-    delete_request_store: filesystem
-    compaction_interval: 10m
-    retention_delete_delay: 2h
  limits_config:
-    retention_period: 168h # 7 days
    reject_old_samples: true
    reject_old_samples_max_age: 168h
    ingestion_rate_mb: 15
@@ -35,8 +28,6 @@ chunksCache:
 resultsCache:
  enabled: false
 singleBinary:
-  persistence:
-    size: 20Gi 
  replicas: 1
  resources:
    requests:
@@ -21,11 +21,6 @@ renovate:
          "assignees": ["danijel.simeunovic"],
          "reviewers": ["danijel.simeunovic"]
        },
-        {
-          "matchRepositories": ["**/launchpad"],
-          "assignees": ["danijel.simeunovic"],
-          "reviewers": ["danijel.simeunovic"]
-        },
        {
          "matchRepositories": ["**/forte-helm"],
          "assignees": ["danijel.simeunovic"],
@@ -1,67 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    "group:allNonMajor",
-    ":dependencyDashboard",
-    ":semanticCommits"
-  ],
-  "timezone": "Europe/Oslo",
-  "labels": ["renovate"],
-  "reviewers": ["danijel.simeunovic"],
-
-  "prConcurrentLimit": 10,
-  "prHourlyLimit": 4,
-  "minimumReleaseAge": "3 days",
-
-  "ignorePaths": [
-    "**/*-sealed.yaml",
-    "cluster-resources/policies/**",
-    "private/**",
-    ".devbox/**"
-  ],
-
-  "argocd": {
-    "description": "ArgoCD Applications live under infra/, apps/ and the root app-of-apps files. The manager skips any file without an argoproj.io apiVersion, so matching broadly is safe.",
-    "managerFilePatterns": [
-      "/^_app-of-apps-.+\\.yaml$/",
-      "/^apps/.+\\.yaml$/",
-      "/^infra/.+\\.yaml$/"
-    ]
-  },
-
-  "helm-values": {
-    "description": "Values files are named <app>-values.yaml, not the default values.yaml.",
-    "managerFilePatterns": ["/^infra/values/.+\\.ya?ml$/"]
-  },
-
-  "kubernetes": {
-    "description": "Plain manifests with inline image references. Kyverno policies are excluded via ignorePaths - their images are Go templates, not tags.",
-    "managerFilePatterns": [
-      "/^cluster-resources/.+\\.yaml$/",
-      "/^apps/.+/resources/.+\\.yaml$/"
-    ]
-  },
-
-  "packageRules": [
-    {
-      "description": "Every Application carries a second source pointing at this repo at HEAD for $values. HEAD is not a version.",
-      "matchDatasources": ["git-tags"],
-      "matchDepNames": ["/forteapps\\.net/"],
-      "enabled": false
-    },
-    {
-      "description": "Platform chart majors usually carry values-schema or CRD breaks - flag them for a careful read.",
-      "matchFileNames": ["infra/**"],
-      "matchUpdateTypes": ["major"],
-      "labels": ["renovate", "breaking-change"],
-      "minimumReleaseAge": "7 days"
-    },
-    {
-      "description": "Patch-level platform bumps are routine - let them through faster.",
-      "matchFileNames": ["infra/**"],
-      "matchUpdateTypes": ["patch"],
-      "minimumReleaseAge": "1 day"
-    }
-  ]
-}