[ExtraToast]

Summary

auth-api 0.21.1's new pods crash at startup: GET transit/keys/auth-api-jwt returns 403 Forbidden, so Spring's jwkSource fails. 0.21.1 moved auth-api onto its derived Vault role auth-system-auth-api (#119), whose policy only granted sign on that key. The JWKS also reads the key's public part. The old role allowed that read, which is why the project file said to stay on it.

• The auth-api-jwt grant declares operations: [sign, read]. deploy-kit 1.0 renders read as read on transit/keys/auth-api-jwt (feat(model): grant read on a transit key deploy-kit#595).
• The comment about the old role's workaround is gone.

To know

• The old 0.20.0 pods keep serving. Flagger never promoted 0.21.1, so sign-in is unaffected.
• After the release, composition re-renders auth's Vault policy and the policy job applies it. Then the new pods can read the key.

Test plan

• deploy-kit validate deploy/auth.project.yml deploy/env on 1.0.1: accepted
• After the release: the auth-api canary's pods start, and Flagger promotes 0.21.x

Part of JorisJonkers-dev/deploy-kit#380.