polaris-bootstrap/manifests/polaris-sync-principals-script.yaml (lines ~192, 198, 201) hardcodes group/role name checks (role_name.startswith("teehr-"), group_name == "iceberg-catalog-admins", etc.) that duplicate — and could drift from — the regex-based mapping already declared in polaris/manifests/polaris-config.yaml.tpl (^iceberg-catalog-admin$, ^teehr-(.+)$).
Impact: Per docs/polaris-identity-propagation-plan.md, new team/domain groups (e.g. hydrology-team) are an intended future extension. Adding one exactly as documented (new Keycloak group + acl-config.yaml.tpl namespace policy) would silently grant nothing — it won't match either hardcoded branch in the sync script, and there's no error, just a permission that never materializes.
Fix: Derive the sync script's mapping from the same source (the regex config, or acl-config.yaml.tpl's namespace policies) instead of a second hand-maintained hardcoded list.
polaris-bootstrap/manifests/polaris-sync-principals-script.yaml (lines ~192, 198, 201) hardcodes group/role name checks (role_name.startswith("teehr-"), group_name == "iceberg-catalog-admins", etc.) that duplicate — and could drift from — the regex-based mapping already declared in polaris/manifests/polaris-config.yaml.tpl (^iceberg-catalog-admin$, ^teehr-(.+)$).
Impact: Per docs/polaris-identity-propagation-plan.md, new team/domain groups (e.g. hydrology-team) are an intended future extension. Adding one exactly as documented (new Keycloak group + acl-config.yaml.tpl namespace policy) would silently grant nothing — it won't match either hardcoded branch in the sync script, and there's no error, just a permission that never materializes.
Fix: Derive the sync script's mapping from the same source (the regex config, or acl-config.yaml.tpl's namespace policies) instead of a second hand-maintained hardcoded list.