Identity Server 8.1.39 — Deployment Notes (DevOps)

[doomedCode]

Release	identity-server@8.1.39 (Newer Version Available 8.1.41 )
Image	neutrinos.azurecr.io/alpha/alpha-identity-server:26.6.8.1.39-714ccc7 (Newer tag - 26.6.8.1.41-8ba7118)

You deploy via your own identity-server chart. This release changes the runtime contract in a few ways you need to reflect in your chart/values. Everything you need is below — the image URL plus the env/securityContext changes.

---

1. Image

The only artifact to pull in:

neutrinos.azurecr.io/alpha/alpha-identity-server:26.6.8.1.39-714ccc7

Port is unchanged: 3005.

---

2. What changed in the runtime contract (action needed in your chart)

Change	What you must do
New env var GCP_SA_KEY_B64 (reCAPTCHA Enterprise key, now injected at runtime)	Add it to the deployment env, sourced from a Secret. See §3.
GOOGLE_APPLICATION_CREDENTIALS is gone	Remove it from the deployment env — there is no key file in the image for it to point at anymore.
Runs as non-root node user	Ensure your securityContext doesn’t force a conflicting UID; any mounted/writable volumes must be writable by node.
No shell in the image — command is node entrypoint.js	kubectl exec ... -- sh won’t work; use -- node ... or an ephemeral debug container if you need to poke around.

---

3. Configure GCP credentials in your chart

The reCAPTCHA Enterprise service-account key is no longer baked into the image (it was flagged CRITICAL/HIGH by the image scan). The app now reads it from an env var and decodes it in memory — nothing is written to disk.

Env contract:

• GCP_SA_KEY_B64 = the full service-account JSON, base64-encoded on a single line.
• If unset, the app falls back to Application Default Credentials — not relevant for the cluster; reCAPTCHA will fail without the var, so it is required in your deployment.

Generate the value (from the service-account JSON file):

base64 < gcpCreds.json | tr -d '\n'

Create the Secret in your namespace (name it whatever your chart expects; example uses ids-gcp-creds):

kubectl -n <namespace> create secret generic ids-gcp-creds \
  --from-literal=GCP_SA_KEY_B64="$(base64 < gcpCreds.json | tr -d '\n')"

Inject it into the deployment env:

env:
  - name: GCP_SA_KEY_B64
    valueFrom:
      secretKeyRef:
        name: ids-gcp-creds
        key: GCP_SA_KEY_B64

---

4. Verification

After deploying the new image:

• Pods healthy and non-root

  kubectl -n <namespace> get pods -l app=<your-label>
  kubectl -n <namespace> exec <pod> -- id     # expect uid != 0 (node user)
  

• Secret wired into env

  kubectl -n <namespace> get secret ids-gcp-creds
  kubectl -n <namespace> get deploy <name> -o yaml | grep -A4 GCP_SA_KEY_B64
  

• reCAPTCHA works — exercise a captcha-protected flow (e.g., password reset) and confirm it succeeds.
• No stale env — confirm GOOGLE_APPLICATION_CREDENTIALS is absent from the deployment env.

---

5. Rollback

• If rolling back to a pre-8.1.39 image, note the old image expects GOOGLE_APPLICATION_CREDENTIALS and an on-disk key. Restore that env var (and remove/ignore GCP_SA_KEY_B64) if you revert.
• Do not restore the old GCP key if it has already been revoked — keep a valid key available for the rollback target.

---

6. Quick reference

Image	neutrinos.azurecr.io/alpha/alpha-identity-server:26.6.8.1.39-714ccc7
Port	3005
Add env	GCP_SA_KEY_B64 (from Secret; base64 of service-account JSON)
Remove env	GOOGLE_APPLICATION_CREDENTIALS
Container command	node entrypoint.js (no shell)
Runtime user	node (non-root)

Contact: Platform Team - support@neutrinos.com