Replaces the 1m refresh (one GET a minute forever, to cover a boot-time
race). Temporal fetches the JWKS once at start and only retries on the
refreshInterval tick; an unknown kid triggers nothing. So an init
container makes the frontend wait until the JWKS answers with a key,
backing off 2-4-8-...-60 s, and refreshInterval goes back to 1h for key
rotations. The chart gives every server service the init containers;
for anything but the frontend it exits at once.
Checked: rendered on all five server Deployments; frontend Deployment
and its pod template pass a server-side dry run (Kyverno, restricted
PSS); the script exits 0 for frontend (keys up) and history (no-op) and
backs off as written against an unreachable URL.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01MdS1HcT3JpVno881Z46fei
MarioGLealPandClaude Opus 5.5
2ee188b3d1