Problem:
- Keycloak operator still adding --optimized to args despite unsupported.podTemplate override
- StatefulSet showed duplicate jgroups args and --optimized flag
- Operator merges args instead of replacing them

Root Cause:
- Keycloak operator's unsupported.podTemplate only merges args, doesn't replace
- Operator always adds --optimized when it detects "optimized build"
- Need to override the entire command to take full control

Solution:
- Added `command: [/opt/keycloak/bin/kc.sh]` to podTemplate
- This prevents operator from injecting its default command+args
- Args now fully controlled by our CR specification
- Removed duplicate jgroups arg

Expected Result:
- StatefulSet will have exactly: command=[kc.sh] args=[jgroups, start, --verbose]
- No --optimized flag
- Keycloak will start successfully on first boot

Ref: keycloak/keycloak#30859

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Problem:
- Keycloak operator ALWAYS adds --optimized flag to container args
- The --optimized flag requires pre-built cache (kc.sh build)
- On fresh installation, Keycloak exits with error instead of building cache
- Operator's unsupported.podTemplate.containers.command/args overrides do NOT work
  * Tested: command override - operator still added --optimized
  * Tested: args override - operator merged (didn't replace) and still added --optimized
  * Root cause: Operator bug in v26.0.7

Solution - InitContainer Workaround:
- Added initContainer that runs `kc.sh build --features=spiffe:v1`
- InitContainer creates optimized cache in shared emptyDir volume
- Main Keycloak container mounts same volume at /opt/keycloak/providers
- When main container starts with --optimized, cache already exists
- No more --optimized flag errors!

Changes:
1. Added initContainer: keycloak-build
   - Runs kc.sh build with SPIFFE feature enabled
   - Shares keycloak-providers volume with main container
2. Removed command/args overrides (they don't work anyway)
3. Main container inherits built cache from initContainer

Result:
- InitContainer runs first, builds cache
- Main container starts with --optimized flag (added by operator)
- Keycloak starts successfully because cache exists

Trade-offs:
- Adds ~5-10s to pod startup time (initContainer build phase)
- But this is acceptable for reliable deployment
- Better than CrashLoopBackOff!

Ref: keycloak/keycloak#30859

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Problem:
- Keycloak Operator ALWAYS adds --optimized flag when starting Keycloak
- --optimized requires pre-built cache (via 'kc.sh build')
- Build-time options (health-enabled, SPIFFE) require running build before start
- Without init container: Keycloak fails "don't use --optimized for first startup"
- WITH init container: Operator copies it to realm import Jobs, causing build errors

Root Cause:
- Keycloak Operator copies ENTIRE unsupported.podTemplate to ALL pods
- This includes StatefulSet pods AND realm import Job pods
- No way to selectively apply pod template only to StatefulSet

Solutions Attempted:
1. ❌ Init container workaround → Inherited by Jobs, causing build config errors
2. ❌ Pod-level annotations → Also inherited by Jobs
3. ❌ Namespace-level sidecar disable → Jobs still got sidecars (label priority)

Temporary Solution (this commit):
- DISABLE build-time options (health-enabled, SPIFFE features)
- Keycloak will start successfully with --optimized and no build required
- Realm import Jobs will also work (no init container to inherit)
- Platform will be functional for development/testing

Trade-offs:
- ❌ No health endpoint (minor - can use readiness probe)
- ❌ No SPIFFE/SPIRE workload identity (can add later)
- ✅ Keycloak StatefulSet starts successfully
- ✅ Realm import Jobs complete successfully
- ✅ Platform functional end-to-end

Future Enhancements (documented in keycloak-cr.yaml):
1. Build custom Keycloak image with features pre-built
2. Use MutatingWebhook to add sidecar.istio.io/inject: false to Job pods
3. Contribute patch to Keycloak Operator for pod template overrides

References:
- Keycloak Operator --optimized issue: keycloak/keycloak#30859
- Istio Jobs lifecycle issue: istio/istio#11659

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>