fill(tb-dev,tb-prod): real RDS security group + private subnet IDs

.github/workflows/validate.yaml

@@ -12,6 +12,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+# Manifest-only repo: no image build/push, so no AWS OIDC (id-token) is needed
+# here (unlike thundermail-deploy). Read-only contents is sufficient to checkout
+# and run the kustomize build gate.
 permissions:
   contents: read
 

.gitignore

@@ -1,2 +1,8 @@
+# OS
 .DS_Store
+Thumbs.db
 *.swp
+
+# IDE
+.idea/
+.vscode/

bases/keycloak/statefulset.yaml

@@ -35,8 +35,15 @@ spec:
         app.kubernetes.io/name: keycloak-customer
         app.kubernetes.io/instance: keycloak-customer-auth
     spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
       nodeSelector:
         role: general
+        # Image is arm64 (mirrored multi-arch); pin arch so it never lands on an
+        # amd64 node if a mixed pool is ever introduced.
+        kubernetes.io/arch: arm64
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: topology.kubernetes.io/zone
@@ -158,4 +165,5 @@ spec:
               mountPath: /opt/keycloak/data
       volumes:
         - name: keycloak-data
-          emptyDir: {}
+          emptyDir:
+            sizeLimit: 1Gi

overlays/tb-dev/aws/db-instance.yaml

@@ -1,5 +1,5 @@
 # tb-dev patch: single-AZ dev DB, no deletion protection, dev SG.
-# REPLACE the SG id from: AWS_PROFILE=mzla-tb-dev pulumi stack output rds_sg_keycloak_id
+# SG id from mzla-tb-dev pulumi stack output rds_sg_keycloak_id.
 apiVersion: rds.services.k8s.aws/v1alpha1
 kind: DBInstance
 metadata:
@@ -11,4 +11,4 @@ spec:
   deletionProtection: false
   backupRetentionPeriod: 7
   vpcSecurityGroupIDs:
-    - "REPLACE_TB_DEV_RDS_SG_KEYCLOAK_ID"
+    - "sg-0550595389f41cfca"

overlays/tb-dev/aws/db-subnet-group.yaml

@@ -1,5 +1,5 @@
 # tb-dev patch: private subnets from mzla-tb-dev (eu-central-1a/b).
-# REPLACE from: AWS_PROFILE=mzla-tb-dev pulumi stack output private_subnet_ids
+# From mzla-tb-dev pulumi stack output private_subnet_ids.
 apiVersion: rds.services.k8s.aws/v1alpha1
 kind: DBSubnetGroup
 metadata:
@@ -9,5 +9,5 @@ spec:
   name: keycloak-customer-db-subnets
   description: "Customer Auth RDS - tb-dev private subnets (eu-central-1a/b)"
   subnetIDs:
-    - "REPLACE_TB_DEV_PRIVATE_SUBNET_A"
-    - "REPLACE_TB_DEV_PRIVATE_SUBNET_B"
+    - "subnet-044e18f3022fb9ee1"  # eu-central-1a — 10.120.64.0/18
+    - "subnet-01084662e5e16dce9"  # eu-central-1b — 10.120.128.0/18

overlays/tb-dev/kustomization.yaml

@@ -10,8 +10,8 @@ resources:
 
 images:
   - name: REPLACE_MZLA_ECR/keycloak-customer
-    newName: REPLACE_MZLA_ECR/keycloak-customer  # set to the mzla ECR repo (issue #531)
-    newTag: REPLACE_TB_DEV_MIRRORED_SHA
+    newName: 718959508124.dkr.ecr.eu-central-1.amazonaws.com/keycloak-customer
+    newTag: keycloak-e7ef91efd43f7619e7fc522fb64737b56efb9ffc
 
 patches:
   # AWS / RDS env-specific values (SG id, subnet ids, identifier)

overlays/tb-prod/aws/db-instance.yaml

@@ -1,5 +1,5 @@
 # tb-prod patch: Multi-AZ, deletion-protected, 14-day backups, prod SG.
-# REPLACE the SG id from: AWS_PROFILE=mzla-tb-prod pulumi stack output rds_sg_keycloak_id
+# SG id from mzla-tb-prod pulumi stack output rds_sg_keycloak_id.
 # engineVersion must match the source Customer Auth RDS for the #142 migration.
 apiVersion: rds.services.k8s.aws/v1alpha1
 kind: DBInstance
@@ -11,5 +11,7 @@ spec:
   multiAZ: true
   deletionProtection: true
   backupRetentionPeriod: 14
+  # Avoid surprise engine bumps during the migration/cutover window (#142).
+  autoMinorVersionUpgrade: false
   vpcSecurityGroupIDs:
-    - "REPLACE_TB_PROD_RDS_SG_KEYCLOAK_ID"
+    - "sg-026550adef0d02cdb"

overlays/tb-prod/aws/db-subnet-group.yaml

@@ -1,5 +1,5 @@
 # tb-prod patch: private subnets from mzla-tb-prod (eu-central-1a/b).
-# REPLACE from: AWS_PROFILE=mzla-tb-prod pulumi stack output private_subnet_ids
+# From mzla-tb-prod pulumi stack output private_subnet_ids.
 apiVersion: rds.services.k8s.aws/v1alpha1
 kind: DBSubnetGroup
 metadata:
@@ -9,5 +9,5 @@ spec:
   name: keycloak-customer-db-subnets
   description: "Customer Auth RDS - tb-prod private subnets (eu-central-1a/b)"
   subnetIDs:
-    - "REPLACE_TB_PROD_PRIVATE_SUBNET_A"
-    - "REPLACE_TB_PROD_PRIVATE_SUBNET_B"
+    - "subnet-085a71891b27bd24c"  # eu-central-1a — 10.130.64.0/18
+    - "subnet-0b863a1876ec121cb"  # eu-central-1b — 10.130.128.0/18

overlays/tb-prod/kustomization.yaml

@@ -12,8 +12,10 @@ resources:
 
 images:
   - name: REPLACE_MZLA_ECR/keycloak-customer
-    newName: REPLACE_MZLA_ECR/keycloak-customer  # set to the mzla ECR repo (issue #531)
-    newTag: REPLACE_TB_PROD_MIRRORED_SHA
+    newName: 689951664252.dkr.ecr.eu-central-1.amazonaws.com/keycloak-customer
+    # Mirrored multi-arch image. Re-align this tag to the accounts-prod release
+    # at the prod cutover (#142); for now it tracks the current main build.
+    newTag: keycloak-e7ef91efd43f7619e7fc522fb64737b56efb9ffc
 
 patches:
   # AWS / RDS: HA prod DB, deletion-protected, prod SG/subnets