feat(keycloak): extraVolumes/extraVolumeMounts for custom themes and providers (1.1.0+up26.8.0)

ci/keycloak/fixtures.yaml

@@ -85,6 +85,28 @@ spec:
           emptyDir: {}
 ---
 apiVersion: v1
+kind: ConfigMap
+metadata:
+  # A MINIMAL BUT REAL LOGIN THEME, so that the install-test actually walks the
+  # path keycloak.extraVolumes exists for (Gitea #88) instead of only rendering
+  # it. ci/keycloak/test-values.yaml mounts it on the SUBPATH
+  # /opt/keycloak/themes/ci-theme - never on /opt/keycloak/themes itself, which
+  # would hide the image's base, keycloak and keycloak.v2 themes.
+  name: ci-keycloak-theme
+data:
+  # A theme's layout is <theme>/<type>/theme.properties, and a ConfigMap key
+  # cannot contain a slash - so the "login/" directory is produced by
+  # items[].path in the volume, which can. That indirection is exactly the part
+  # of the theme route a render cannot verify and a running pod can.
+  theme.properties: |
+    parent=keycloak.v2
+    # The reason the issue was opened: Keycloak has no logo field on an identity
+    # provider, so the icon on its login button comes only from a login theme.
+    # Nothing in CI drives a browser, so this line is carried rather than
+    # checked - what the run proves is that the theme reaches the container.
+    kcLogoIdP-ci-provider = fa fa-lock
+---
+apiVersion: v1
 kind: Service
 metadata:
   name: postgres