Andrei Kvapil b62f1caf07 fix(keycloak): replace only the old static KEK form, refuse the rest ...

Any stored KEK that did not decode to exactly 44 characters was
overwritten. The proxy skips CR and LF when it decodes KKP_KEK, so a
key restored from a file ending in a newline works, and the chart
replaced it silently. A 44-character value that is not base64 of 32
bytes was kept, and the proxy could not start with it.

Only the 32-character alphanumeric form earlier chart versions wrote
is replaced now. A key the proxy accepts is kept, and anything else
fails the render, so key material is never overwritten.

Assisted-by: LLM
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>

2026-10-19 17:46:56 +00:00

..

apps

feat(bucket): add a ui flag to skip the s3manager web UI (#4881)

2026-10-12 17:49:41 +03:00

core

fix(e2e): keep chainsaw asserts polling through transient API errors (#4867)

2026-10-12 17:25:39 +03:00

extra

fix(etcd): leave compaction to etcd and pass the real quota to defrag

2026-10-11 20:21:26 +03:00

library

feat(kubernetes-nodes): let CDI trust a self-hosted Talos image factory

2026-10-10 22:36:49 +03:00

system

fix(keycloak): replace only the old static KEK form, refuse the rest

2026-10-19 17:46:56 +00:00

tests/cozy-lib-tests

feat(kubernetes-nodes): let CDI trust a self-hosted Talos image factory

2026-10-10 22:36:49 +03:00