From 118d6b3887a6c170491283e43132a1bf4818ad38 Mon Sep 17 00:00:00 2001
From: Adam Weingarten <6517820+aweingarten@users.noreply.github.com>
Date: Tue, 28 Jul 2026 10:08:37 -0400
Subject: [PATCH] fix(oauth2-proxy): poll keycloak over the backchannel in
 wait-for-keycloak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `wait-for-keycloak` init container polls the public issuer URL
(`https://keycloak.<domainSuffix>/realms/otomi`) with a plain
`curlimages/curl`. It is sidecar-less by definition, which means it hits
two walls the mesh would otherwise hide:

- the host is an Istio ServiceEntry with no in-cluster DNS record, so
  sidecar-less pods can't resolve it at all;
- when it does resolve, the Otomi-signed wildcard cert isn't trusted by
  a vanilla curl image, so it exits 60 (self-signed certificate in
  certificate chain).

Either way the container loops forever and oauth2-proxy never starts,
with no chart value exposing the image, a CA mount, or the curl args to
work around it.

Point the poll at `_derived.oidcBaseUrlBackchannel` — the in-cluster
`http://keycloak-keycloakx-http.keycloak:8080/realms/otomi` URL that
already exists for exactly this purpose and is used by
kubernetes-gateways for its JWKS endpoint. Plain HTTP to a ClusterIP
Service: nothing to resolve through the mesh, nothing to trust.

The gate itself is unchanged — both URLs return 200 only once the otomi
realm is being served, so this changes the route, not the condition.

Refs #3388, #3420
---
 values/oauth2-proxy/oauth2-proxy.gotmpl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/values/oauth2-proxy/oauth2-proxy.gotmpl b/values/oauth2-proxy/oauth2-proxy.gotmpl
index 4bb3eba654..daf8529eae 100644
--- a/values/oauth2-proxy/oauth2-proxy.gotmpl
+++ b/values/oauth2-proxy/oauth2-proxy.gotmpl
@@ -82,7 +82,10 @@ extraInitContainers:
     image: curlimages/curl:latest
     {{- end }}
     command: ["/bin/sh","-c"]
-    args: ["while [ $(curl -sw '%{http_code}' {{ $v._derived.oidcBaseUrl }} -o /dev/null) -ne 200 ]; do sleep 2; echo 'Waiting for Keycloak OIDC Issuer URL'; done"]
+    # Polls the backchannel URL, not the public issuer: this container is sidecar-less, so it can
+    # neither resolve the keycloak ServiceEntry host nor trust an Otomi-issued cert. Both reach the
+    # same realm, so the gate is unchanged — only the route is.
+    args: ["while [ $(curl -sw '%{http_code}' {{ $v._derived.oidcBaseUrlBackchannel }} -o /dev/null) -ne 200 ]; do sleep 2; echo 'Waiting for Keycloak OIDC Issuer URL'; done"]
 
 {{- if $v.otomi.linodeLkeImageRepository }}
 initContainers: