Upgrade Passmower to 2.3.0 and migrate client compatibility

wiki/application.yaml

@@ -15,52 +15,53 @@ spec:
     - refresh_token
   responseTypes:
     - code
+  # Preserve 1.x email claims for clients whose requests only include profile.
+  overrideIncomingScopes: true
   availableScopes:
+    - email
     - openid
     - profile
     - groups
   tokenEndpointAuthMethod: client_secret_post
   pkce: false
-  secretRefreshPod:
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: reset-oidc-config
-    spec:
-      volumes:
-        - name: tmp
-          emptyDir: {}
-      initContainers:
-        - name: jq
-          image: mirror.gcr.io/alpine/k8s:1.35.0
-          imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp
-          envFrom:
-            - secretRef:
-                name: oidc-client-wiki-owner-secrets
-          command:
-            - /bin/sh
-            - -c
-            - jq '{"strategyKey":"oidc","config":{"clientId":$ENV.OIDC_CLIENT_ID,"clientSecret":$ENV.OIDC_CLIENT_SECRET,"authorizationURL":$ENV.OIDC_IDP_AUTH_URI,"tokenURL":$ENV.OIDC_IDP_TOKEN_URI,"userInfoURL":$ENV.OIDC_IDP_USERINFO_URI,"skipUserProfile":false,"issuer":$ENV.OIDC_IDP_URI,"emailClaim":"email","displayNameClaim":"name","mapGroups":true,"groupsClaim":"groups","logoutURL":$ENV.OIDC_IDP_URI,"acrValues":""}} | "UPDATE authentication SET config=\(.config|tostring|@sh) WHERE \"strategyKey\"=\(.strategyKey|tostring|@sh)"' -n -r > /tmp/update.sql
-      containers:
-        - name: psql
-          image: mirror.gcr.io/alpine/psql
-          imagePullPolicy: IfNotPresent
-          volumeMounts:
-            - mountPath: /tmp
-              name: tmp
-          env:
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: postgres-appuser-password
-                  key: password
-          command:
-            - /bin/sh
-            - -c
-            - psql -U kspace_wiki -d wiki -h postgres < /tmp/update.sql
+  secretRefreshJobSpec:
+    template:
+      spec:
+        restartPolicy: OnFailure
+        volumes:
+          - name: tmp
+            emptyDir: {}
+        initContainers:
+          - name: jq
+            image: mirror.gcr.io/alpine/k8s:1.35.0
+            imagePullPolicy: IfNotPresent
+            volumeMounts:
+              - mountPath: /tmp
+                name: tmp
+            envFrom:
+              - secretRef:
+                  name: oidc-client-wiki-owner-secrets
+            command:
+              - /bin/sh
+              - -c
+              - jq '{"strategyKey":"oidc","config":{"clientId":$ENV.OIDC_CLIENT_ID,"clientSecret":$ENV.OIDC_CLIENT_SECRET,"authorizationURL":$ENV.OIDC_IDP_AUTH_URI,"tokenURL":$ENV.OIDC_IDP_TOKEN_URI,"userInfoURL":$ENV.OIDC_IDP_USERINFO_URI,"skipUserProfile":false,"issuer":$ENV.OIDC_IDP_URI,"emailClaim":"email","displayNameClaim":"name","mapGroups":true,"groupsClaim":"groups","logoutURL":$ENV.OIDC_IDP_URI,"acrValues":""}} | "UPDATE authentication SET config=\(.config|tostring|@sh) WHERE \"strategyKey\"=\(.strategyKey|tostring|@sh)"' -n -r > /tmp/update.sql
+        containers:
+          - name: psql
+            image: mirror.gcr.io/alpine/psql
+            imagePullPolicy: IfNotPresent
+            volumeMounts:
+              - mountPath: /tmp
+                name: tmp
+            env:
+              - name: PGPASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: postgres-appuser-password
+                    key: password
+            command:
+              - /bin/sh
+              - -c
+              - psql -U kspace_wiki -d wiki -h postgres < /tmp/update.sql
 ---
 apiVersion: apps/v1
 kind: StatefulSet