<!--
  ~ Licensed to the Apache Software Foundation (ASF) under one
  ~ or more contributor license agreements.  See the NOTICE file
  ~ distributed with this work for additional information
  ~ regarding copyright ownership.  The ASF licenses this file
  ~ to you under the Apache License, Version 2.0 (the
  ~ "License"); you may not use this file except in compliance
  ~ with the License.  You may obtain a copy of the License at
  ~
  ~   http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing,
  ~ software distributed under the License is distributed on an
  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  ~ KIND, either express or implied.  See the License for the
  ~ specific language governing permissions and limitations
  ~ under the License.
  -->

# Legacy embedded SSO configuration ownership

The public `ops config sso` command is supplied by the task repository. The
embedded `ops -config sso` form remains temporarily available for compatibility
with already published scripts and installations. It manages the following
configuration. Resource names can be changed with `--configmap`, `--secret`,
`--statefulset`, and `--container`.

## Kubernetes resources

The command creates and owns a dedicated ConfigMap. Its default name is
`openserverless-sso-config`, and it contains exactly these keys:

- `OIDC_ISSUER_URL`
- `OIDC_JWKS_URL`
- `OIDC_AUDIENCE`
- `OIDC_CLIENT_ID`
- `OIDC_REQUIRED_GROUP`
- `OIDC_USERNAME_CLAIM`
- `OIDC_GROUPS_CLAIM`
- `SSO_AUTOPROVISION_ON_LOGIN`
- `SSO_AUTOPROVISION_TIMEOUT_SECONDS`
- `SSO_AUTOPROVISION_POLL_SECONDS`
- `SSO_AUTOPROVISION_DEFAULT_SERVICES`
- `SSO_NAMESPACE_PRESERVE_VALID`
- `SSO_NAMESPACE_HASH_LENGTH`
- `SSO_NAMESPACE_MAX_LENGTH`

When `--client-secret` is supplied, the command also creates and owns a
dedicated Secret. Its default name is `openserverless-sso-secret`, and its only
managed key is `OIDC_CLIENT_SECRET`.

The command adds exact, prefix-free `envFrom` references for the managed
ConfigMap and, when applicable, the managed Secret to the selected admin-api
container. It does not create direct `env` entries, volumes, volume mounts, or
annotations.

## Disable behavior

`ops config sso disable` removes only the exact `envFrom` references described
above and deletes the two dedicated resources with Kubernetes
`--ignore-not-found`. Other `envFrom` entries, all direct `env` entries,
volumes, volume mounts, and existing annotations remain unchanged.

The command is idempotent. If neither managed reference is present, no patch or
rollout command is issued for the StatefulSet. Missing ConfigMaps and Secrets
are not errors. Removing an `envFrom` entry changes the pod template, so
Kubernetes starts the necessary rollout itself. By default the command waits
for that rollout; `--no-rollout` skips the wait and does not issue an additional
restart.

The local `~/.ops/config.json` cleanup is also limited to the keys written by
the SSO command. Unrecognized `SSO_*` keys are preserved.