fix(kratos): improve init container OIDC validation and error messages

[colek42]

Summary

Fixes customer issue where missing OIDC credentials resulted in nil values and Kratos startup failures with unhelpful error messages.

Problem

Customer reported this error:

selfservice.methods.oidc.config.providers.0.client_id: <nil>
selfservice.methods.oidc.config.providers.0.client_secret: <nil>

Root cause: The init container was replacing ${OIDC_GITHUB_CLIENT_ID} placeholders with empty strings when environment variables weren't set, producing nil values.

Solution

Improved the Kratos init container to:

1. Detect if OIDC is enabled - Only validates credentials when OIDC placeholders exist in config
2. Fail fast with clear errors - Exits immediately when OIDC enabled but credentials missing
3. Show ALL required secrets - Lists complete set of required Kubernetes secret keys
4. Provide exact troubleshooting steps - Templated kubectl commands with actual secret names
5. Use correct secret generation - openssl rand -hex 16 (32 hex chars exactly)

Error Message Now Shows

=========================================
FATAL: Missing OIDC Credentials
=========================================

Required keys for Kratos:
- dsn                     (Database connection string)
- secretsCookie           (Cookie encryption, min 16 chars, 32 recommended)
- secretsCipher           (Field encryption, MUST be exactly 32 chars)
- oidcGithubClientId      (GitHub OAuth Client ID) ← MISSING
- oidcGithubClientSecret  (GitHub OAuth Secret) ← MISSING

Example: Create the complete secret manually:
kubectl create secret generic kratos \
  --from-literal=dsn='postgres://user:pass@host:5432/kratos' \
  --from-literal=secretsCookie=$(openssl rand -hex 16) \
  --from-literal=secretsCipher=$(openssl rand -hex 16) \
  --from-literal=oidcGithubClientId='YOUR_GITHUB_CLIENT_ID' \
  --from-literal=oidcGithubClientSecret='YOUR_GITHUB_SECRET'

Testing

Validated using TDD/TCR methodology with black-box tests:

• ✅ OIDC enabled + missing credentials → Fails with helpful error
• ✅ OIDC enabled + empty credentials → Fails with helpful error
• ✅ OIDC enabled + partial credentials → Fails with helpful error
• ✅ OIDC enabled + valid credentials → Succeeds with validation
• ✅ OIDC disabled + no credentials → Succeeds, skips validation

Changes

• charts/kratos/templates/deployment-kratos.yaml: Improved init container logic
• charts/kratos/Chart.yaml: Bump version 1.6.31 → 1.6.34
• charts/judge/Chart.yaml: Bump version 1.8.40 → 1.8.43

Secret Length Requirements

Verified against Kratos source code:

• secretsCipher: MUST be exactly 32 chars (validated at config.go:831-849)
• secretsCookie: Min 16 chars, 32 recommended (per config.schema.json)
• Command openssl rand -hex 16 produces exactly 32 hex characters

Commits

1. feb360a - Main fix with conditional OIDC validation
2. e8e86db - Show ALL required secret keys in error
3. 92070af - Use correct secret generation (openssl rand -hex 16)

Co-Authored-By: Claude noreply@anthropic.com

[github-actions]

❌ Helm Dependencies Check Failed

Stale Helm dependencies detected! This means .tgz files are older than source files.

How to fix:

1. Run make deps in your local repo
2. Commit the updated .tgz files
3. Push your changes

Why this matters: Stale dependencies cause ArgoCD to deploy outdated configs, leading to issues like missing Vault annotations.

See the Makefile for more details.