fix(official-bots): mount JWT public key from ncs-jwt-keys #415

2026-06-17T09:59:41+02:00

Janis commented

2026-06-17 09:59:41 +02:00

No description provided.

Janis added 3 commits 2026-06-17 09:59:43 +02:00

fix(official-bots): mount JWT public key from ncs-jwt-keys

Delete PR Branch On Close / delete-branch (pull_request) Successful in 6s

Details

cfb25eff8c

The official-bots rollout never mounted the ncs-jwt-keys secret nor set
JWT_PUBLIC_KEY_PATH, so the service fell back to the image-baked
public.pem, which does not match the deployed signing key. Every token
failed RS256 verification -> 401.

Mount ncs-jwt-keys at /secrets/jwt and point JWT_PUBLIC_KEY_PATH there,
mirroring account/core/tournament. Verify-only, no private key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chore(official-bots): debug logging for JWT verify on staging

Delete PR Branch On Close / delete-branch (pull_request) Successful in 6s

Details

f0dc9fd145

Enable DEBUG for io.smallrye.jwt and io.quarkus.security on the
official-bots rollout in staging only (container env, not the shared
ConfigMap) to diagnose the persistent 401. Remove after root cause.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fix(official-bots): set JWT verify props via env

Delete PR Branch On Close / delete-branch (pull_request) Has been skipped

Details

dfb2dfcd32

Logs show JWTAuthContextInfo with publicKeyLocation=null and
issuedBy=null -> "Verification key is unresolvable". The running image
has no mp.jwt.verify config, and JWT_PUBLIC_KEY_PATH only matters if the
baked config references it, which this image does not.

Set the MicroProfile properties directly through the environment
(MP_JWT_VERIFY_PUBLICKEY_LOCATION, MP_JWT_VERIFY_ISSUER) so verification
works on the current image without a rebuild. The mounted ncs-jwt-keys
secret supplies the matching public key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Janis closed this pull request

2026-06-17 10:01:22 +02:00

Janis deleted branch fix/official-bots-jwt-mount

2026-06-17 10:01:23 +02:00

Delete PR Branch On Close / delete-branch (pull_request) Has been skipped

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NowChess/GitOps#415