Upgrade Passmower to 2.3.0 and migrate client compatibility

gitea/application.yaml

@@ -76,50 +76,49 @@ spec:
   responseTypes:
     - code
   availableScopes:
+    - email
     - openid
     - profile
   overrideIncomingScopes: true
   pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
-    spec:
-      volumes:
-        - name: tmp
-          emptyDir: {}
-      initContainers:
-        - name: jq
-          image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730
-          imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp
-          envFrom:
-            - secretRef:
-                name: oidc-client-gitea-owner-secrets
-          command:
-            - /bin/bash
-            - -c
-            - jq '{"strategyKey":"OpenID","config":{"Provider":"openidConnect","ClientID":$ENV.OIDC_CLIENT_ID,"ClientSecret":$ENV.OIDC_CLIENT_SECRET,"OpenIDConnectAutoDiscoveryURL":"https://auth.k-space.ee/.well-known/openid-configuration","CustomURLMapping":null,"IconURL":"","Scopes":null,"RequiredClaimName":"","RequiredClaimValue":"","GroupClaimName":"","AdminGroup":"","GroupTeamMap":"","GroupTeamMapRemoval":false,"RestrictedGroup":""}} | "UPDATE login_source SET cfg=\(.config|tostring|@sh) WHERE name=\(.strategyKey|tostring|@sh) LIMIT 1"' -n -r > /tmp/update.sql
-      containers:
-        - name: mysql
-          image: mirror.gcr.io/library/mysql:latest
-          imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp
-          env:
-            - name: MYSQL_PWD
-              valueFrom:
-                secretKeyRef:
-                  name: mariadb-secrets
-                  key: MYSQL_PASSWORD
-          command:
-            - /bin/bash
-            - -c
-            - mysql -u gitea gitea -h mariadb -p${MYSQL_PWD} < /tmp/update.sql
+  secretRefreshJobSpec:
+    template:
+      spec:
+        restartPolicy: OnFailure
+        volumes:
+          - name: tmp
+            emptyDir: {}
+        initContainers:
+          - name: jq
+            image: mirror.gcr.io/alpine/k8s:1.31.76@sha256:2a3fdd639c71c6cad69fbc8cac2467648855dac29961efec3b155466cc4fa730
+            imagePullPolicy: IfNotPresent
+            volumeMounts:
+              - mountPath: /tmp
+                name: tmp
+            envFrom:
+              - secretRef:
+                  name: oidc-client-gitea-owner-secrets
+            command:
+              - /bin/bash
+              - -c
+              - jq '{"strategyKey":"OpenID","config":{"Provider":"openidConnect","ClientID":$ENV.OIDC_CLIENT_ID,"ClientSecret":$ENV.OIDC_CLIENT_SECRET,"OpenIDConnectAutoDiscoveryURL":"https://auth.k-space.ee/.well-known/openid-configuration","CustomURLMapping":null,"IconURL":"","Scopes":null,"RequiredClaimName":"","RequiredClaimValue":"","GroupClaimName":"","AdminGroup":"","GroupTeamMap":"","GroupTeamMapRemoval":false,"RestrictedGroup":""}} | "UPDATE login_source SET cfg=\(.config|tostring|@sh) WHERE name=\(.strategyKey|tostring|@sh) LIMIT 1"' -n -r > /tmp/update.sql
+        containers:
+          - name: mysql
+            image: mirror.gcr.io/library/mysql:latest
+            imagePullPolicy: IfNotPresent
+            volumeMounts:
+              - mountPath: /tmp
+                name: tmp
+            env:
+              - name: MYSQL_PWD
+                valueFrom:
+                  secretKeyRef:
+                    name: mariadb-secrets
+                    key: MYSQL_PASSWORD
+            command:
+              - /bin/bash
+              - -c
+              - mysql -u gitea gitea -h mariadb -p${MYSQL_PWD} < /tmp/update.sql
 ---
 apiVersion: apps/v1
 kind: StatefulSet