infra/helm/big-reference/templates/_helpers.tpl

@@ -94,6 +94,10 @@ volumes:
       {{- with .defaultMode }}
       defaultMode: {{ . }}
       {{- end }}
+      {{- with .items }}
+      items:
+{{- toYaml . | nindent 8 }}
+      {{- end }}
 {{- end }}
 {{- with $w.data }}
   - name: data

infra/helm/big-reference/templates/deployments.yaml

@@ -30,8 +30,8 @@ spec:
       annotations:
         checksum/portal-config: {{ include "big.keycloakUrl" $ | sha256sum }}
       {{- end }}
-      {{- /* subPath mounts never refresh, so Keycloak restarts when the toggle flips. */}}
-      {{- if eq .configMap "kc-theme-js" }}
+      {{- /* Keycloak reads the theme at startup, so it restarts when the toggle flips. */}}
+      {{- if eq .configMap "kc-theme" }}
       annotations:
         checksum/otp-autofill: {{ $.Values.demo.otpAutofill | toString | sha256sum }}
       {{- end }}

infra/helm/big-reference/templates/keycloak-theme.yaml

@@ -1,9 +1,13 @@
 {{- /*
-Keycloak login theme `big-demo`: keycloak.v2 plus one script. It is always
+Keycloak theme `big-demo`: keycloak.v2 plus one login script. It is always
 mounted and always the default theme (KC_SPI_THEME_DEFAULT), so the only thing
 `demo.otpAutofill` switches is what that script does. Off, it is empty and the
 login is exactly keycloak.v2.
 
+KC_SPI_THEME_DEFAULT covers every theme type, and Keycloak does not fall back
+for a type the theme lacks (the account console 500s), so account, admin and
+email are declared too, each a plain child of Keycloak 26's own default.
+
 On, the medewerker OTP step computes the code from the realm fixture secret
 (docs/runbooks/keycloak.md) and submits it: the demo still shows MFA being
 enforced without anyone needing an authenticator. The secret is committed and
@@ -17,18 +21,16 @@ metadata:
   labels:
 {{- include "big.labels" (dict "root" $ "name" "kc-theme") | nindent 4 }}
 data:
-  theme.properties: |
+  login.properties: |
     parent=keycloak.v2
     import=common/keycloak
     scripts=js/otp-autofill.js
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kc-theme-js
-  labels:
-{{- include "big.labels" (dict "root" $ "name" "kc-theme-js") | nindent 4 }}
-data:
+  account.properties: |
+    parent=keycloak.v3
+  admin.properties: |
+    parent=keycloak.v2
+  email.properties: |
+    parent=keycloak
   otp-autofill.js: |
 {{- if .Values.demo.otpAutofill }}
     // RFC 6238 with Keycloak's default policy (HmacSHA1, 6 digits, 30 s) over the

infra/helm/big-reference/values.yaml

@@ -289,8 +289,14 @@ workloads:
     probe: { tcpSocket: { port: 8080 }, initialDelaySeconds: 15 }
     files:
       - { configMap: rr-kc-realms, mountPath: /opt/keycloak/data/import }
-      - { configMap: kc-theme, mountPath: /opt/keycloak/themes/big-demo/login/theme.properties, subPath: theme.properties }
-      - { configMap: kc-theme-js, mountPath: /opt/keycloak/themes/big-demo/login/resources/js/otp-autofill.js, subPath: otp-autofill.js }
+      - configMap: kc-theme
+        mountPath: /opt/keycloak/themes/big-demo
+        items:
+          - { key: login.properties, path: login/theme.properties }
+          - { key: otp-autofill.js, path: login/resources/js/otp-autofill.js }
+          - { key: account.properties, path: account/theme.properties }
+          - { key: admin.properties, path: admin/theme.properties }
+          - { key: email.properties, path: email/theme.properties }
 
   # ── Flowable (S-03) ─────────────────────────────────────────────────────────
   flowable-db: