From 5fcb40f07ea132ed4f4453824b41aa8068b5aa30 Mon Sep 17 00:00:00 2001 From: Ivan Okhotnikov Date: Wed, 1 Jul 2026 00:25:15 +0300 Subject: [PATCH] fix(apps/kubernetes): switch audience mapper to included.client.audience MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Self-review fix: the KeycloakClientScope rendered for the per-cluster audience used `included.custom.audience` (raw string), but the project convention — set in `packages/system/keycloak-configure/templates/configure-kk.yaml` for the legacy global `kubernetes-client` scope — is `included.client.audience` (refers to a clientId in the same realm). Both keys make Keycloak emit the audience claim with the same value in our setup, but the `client.audience` form is the idiomatic one when the audience IS a registered client in the realm. Signed-off-by: Ivan Okhotnikov --- packages/apps/kubernetes/templates/oidc-keycloak.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/apps/kubernetes/templates/oidc-keycloak.yaml b/packages/apps/kubernetes/templates/oidc-keycloak.yaml index f6eaf72cc..b7c1bbb0d 100644 --- a/packages/apps/kubernetes/templates/oidc-keycloak.yaml +++ b/packages/apps/kubernetes/templates/oidc-keycloak.yaml @@ -45,7 +45,7 @@ spec: protocol: openid-connect protocolMapper: "oidc-audience-mapper" config: - "included.custom.audience": {{ $clientId | quote }} + "included.client.audience": {{ $clientId | quote }} "id.token.claim": "true" "access.token.claim": "true" "introspection.token.claim": "true"