From c64142ffed83be6566d60bd7079e2feace642b3f Mon Sep 17 00:00:00 2001 From: Janis Date: Wed, 17 Jun 2026 10:01:11 +0200 Subject: [PATCH 1/2] fix(official-bots): resolve JWT verify key via MP env props The merged rollout set JWT_PUBLIC_KEY_PATH, but the running image's config never references it, so mp.jwt.verify.publickey.location stayed null and every token failed with "Verification key is unresolvable". Replace it with the MicroProfile properties the runtime reads directly (MP_JWT_VERIFY_PUBLICKEY_LOCATION, MP_JWT_VERIFY_ISSUER), pointing at the already-mounted ncs-jwt-keys public key. No image rebuild needed. Co-Authored-By: Claude Opus 4.8 --- nowchess/base/nowchess-rollouts.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nowchess/base/nowchess-rollouts.yaml b/nowchess/base/nowchess-rollouts.yaml index 108dc04..b13b0ad 100755 --- a/nowchess/base/nowchess-rollouts.yaml +++ b/nowchess/base/nowchess-rollouts.yaml @@ -441,8 +441,10 @@ spec: key: INTERNAL_SECRET - name: ACCOUNT_SERVICE_URL value: http://nowchess-account:8083 - - name: JWT_PUBLIC_KEY_PATH + - name: MP_JWT_VERIFY_PUBLICKEY_LOCATION value: /secrets/jwt/public.pem + - name: MP_JWT_VERIFY_ISSUER + value: nowchess volumeMounts: - name: jwt-keys mountPath: /secrets/jwt -- 2.52.0 From 854c00dd4f614ca9bae50d9a476b0031c0ec3851 Mon Sep 17 00:00:00 2001 From: Janis Date: Wed, 17 Jun 2026 10:18:19 +0200 Subject: [PATCH 2/2] feat(htwg-1): park official expert bot on tournament server Seal TOURNAMENT_BOT_TOKEN as ncs-tournament-bot-secret and inject it plus TOURNAMENT_SERVER_URL into the official-bots rollout so the bot parks itself on http://141.37.123.132:8086 at startup. Co-Authored-By: Claude Opus 4.8 --- nowchess/htwg-1-prod/kustomization.yaml | 21 +++++++++++++++++++ secrets/htwg-1/kustomization.yaml | 1 + secrets/htwg-1/ncs-tournament-bot-secret.yaml | 13 ++++++++++++ 3 files changed, 35 insertions(+) create mode 100644 secrets/htwg-1/ncs-tournament-bot-secret.yaml diff --git a/nowchess/htwg-1-prod/kustomization.yaml b/nowchess/htwg-1-prod/kustomization.yaml index 233fde3..07bd83e 100755 --- a/nowchess/htwg-1-prod/kustomization.yaml +++ b/nowchess/htwg-1-prod/kustomization.yaml @@ -30,6 +30,27 @@ patches: target: kind: ConfigMap name: nowchess-frontend-env-config +- patch: |- + apiVersion: argoproj.io/v1alpha1 + kind: Rollout + metadata: + name: nowchess-official-bots + spec: + template: + spec: + containers: + - name: nowchess-official-bots + env: + - name: TOURNAMENT_SERVER_URL + value: http://141.37.123.132:8086 + - name: TOURNAMENT_BOT_TOKEN + valueFrom: + secretKeyRef: + name: ncs-tournament-bot-secret + key: TOURNAMENT_BOT_TOKEN + target: + kind: Rollout + name: nowchess-official-bots images: - name: ghcr.io/now-chess/now-chess-systems/account newTag: 0.25.0-x86_v2 diff --git a/secrets/htwg-1/kustomization.yaml b/secrets/htwg-1/kustomization.yaml index 0c6218a..681aa9c 100755 --- a/secrets/htwg-1/kustomization.yaml +++ b/secrets/htwg-1/kustomization.yaml @@ -10,3 +10,4 @@ resources: - ncs-internal-secret.yaml - remotek6-certs.yaml - postgres-credentials.yaml + - ncs-tournament-bot-secret.yaml diff --git a/secrets/htwg-1/ncs-tournament-bot-secret.yaml b/secrets/htwg-1/ncs-tournament-bot-secret.yaml new file mode 100644 index 0000000..f54cadc --- /dev/null +++ b/secrets/htwg-1/ncs-tournament-bot-secret.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: ncs-tournament-bot-secret + namespace: nowchess +spec: + encryptedData: + TOURNAMENT_BOT_TOKEN: AgBeVXB71v/88ksndl+bn4k8niG7rlKCDxWEinMgxh0vqLjtB/BWwwhhRp7064/jFH7Qt02nb9TF8N4+GIiBNykIGQLQtUBzvMp7I7EGSAHNsFSlXFTURQQJo5+C8L/H9c0UDQ+gunqCinz2mEZw1LlnMgQEqfMN3RCVK9YtW6f76jk3WLpet4g082lfy9cou2FZ+AgQq3zSBf6//OmlqrKRLkve1Nbxy4dS2IAvfLd/OdiC29sFs41nk3TFyrR9jPg8P4cYfd99O9XhabKRrCR8J1TxovCiWWQVBI+E1mmbQW5d6pcw1qO2fYsRGvdVb7DB+IiV3WjMHO6U3T/TV8sHhhAUSMELtD0NIfXyphkevK7Mtd3wPHgk6U2vTpNH3kionywff8jBeM8xWmTCOnHgRlCRoUrigysbAKNwGKjqEdWM3En8qKf4o6aTxFoQODIa09esivqcXs6U7WzqXWxjrZDVwsjauzC+eUyvJQv+yDPHSMjUt35r/CZF9xuOtRPG0ZmKmO6yAlbgLBnSYiOeEa9xPxhh3n7+kV9TijHgnxcsGhfzpxzQLJ49g7TPkSqudC+wZtMKt719HrW3SPiUnIT521ntqvaBGc+O8+AA1lEB5OaIfN1yKjUZmy7zPZhHG7wtTVBaXisXV0qdw62/V9aejgClb2S7OvXx7tuA4hrwKMXNyZ+YlN+10g6mIaxD62naiWRbrXdKy1dpgqtqq4erOUdGX09twWJ1kUWb0azUNV6BJTUinyTjh8bzbdq3cJ+IYm8gSe8QovAe9vpwAt9rRGTE8+lHBzUcEzQZwNQfK8FqqvHa2wDbFTaVt5G6wVNtGb2DLvlcIMKe5zSads0W0rwKXEKl2YUvZtBdVkdQvJD3/GlC4zBa7/TmIqCj + template: + metadata: + name: ncs-tournament-bot-secret + namespace: nowchess -- 2.52.0