Ivan Okhotnikov de6240270c docs(oidc): reframe emailVerified as prescriptive, not chart-enforced ...

Prior wording overstated Phase 1: the rendered
AuthenticationConfiguration carries no claimValidationRules, so the
chart itself does not gate on email_verified. Rewrite the failure-mode
bullet to describe the layered guarantees operators actually rely on:

  1. provisioning KeycloakRealmUsers with emailVerified: true,
  2. Keycloak's realm-level duplicateEmails: false as an
     impersonation-through-second-account guard,
  3. the k8s upstream side-effect that rejects tokens explicitly
     carrying email_verified: false.

Also flag CEL claimValidationRules as a reasonable follow-up hardening
path, but explicitly out of scope for Phase 1 per the design doc.

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

2026-07-06 09:25:07 +03:00

..

agents

ci: address CodeRabbit review on build-matrix workflow

2026-06-25 17:51:38 +05:00

changelogs

docs(release): add changelog for v1.4.5 (#3083)

2026-07-03 17:50:16 +05:00

operations

feat(platform): add default backupclass

2026-05-28 13:49:59 +04:00

gpu-vgpu.md

docs(gpu-operator): document passthrough variant host-driver prerequisite

2026-06-10 02:12:05 +03:00

hubble-observability.md

docs: add Hubble network observability documentation and dashboards

2026-01-02 04:17:56 +08:00

oidc-tenant.md

docs(oidc): reframe emailVerified as prescriptive, not chart-enforced

2026-07-06 09:25:07 +03:00

release.md

docs(release): document automated patch-release cron and support window

2026-06-21 14:26:15 +03:00

storage-immutability.md

build(dashboard): pin console image builder to pnpm 11.1.2 and repoint vendor doc link

2026-06-26 20:00:12 +05:00