oidc-bootstrap hook blocks kubernetes-* upgrades on clusters without the Keycloak CRDs (ineffective api-resources guard) #3516

What happened

The oidc-bootstrap Job (packages/apps/kubernetes/templates/oidc-rbac-job.yaml), which runs as a
post-install,post-upgrade Helm hook with backoffLimit: 6, fails on any cluster that does not have the
Keycloak operator CRDs installed, even at oidc.mode: None:

mode=None: force-cleaning chart-owned OIDC resources Helm's SSA apply cannot reap...
  patching KamajiControlPlane <cluster> — remove OIDC-only entries ...
  deleting chart-owned OIDC Secrets
  deleting chart-owned Keycloak objects
error: the server doesn't have a resource type "keycloakclient"

Because it is a hook, the failure blocks the Helm upgrade of the kubernetes-<cluster> release.

Root cause

The cleanup step is guarded, but the guard is ineffective:

if kubectl api-resources --api-group=v1.edp.epam.com >/dev/null 2>&1; then
  echo "  deleting chart-owned Keycloak objects"
  kubectl ... delete keycloakclient.v1.edp.epam.com ... --ignore-not-found

kubectl api-resources --api-group=<absent group> exits 0 and simply prints an empty list, so the guard
always passes. The subsequent delete then fails because the resource type is unknown, and --ignore-not-found
does not help for an unknown type (only for a missing object).

Impact

On a cluster without the Keycloak operator (a perfectly supported configuration: oidc.mode: None is the
default), every kubernetes-* HelmRelease upgrade is blocked until the CRDs are installed. Our workaround was to
apply the two CRDs (keycloakclients, keycloakclientscopes) empty, with no operator and no CRs, purely to make
the guard's delete succeed.

Suggested fix

Guard on a non-empty result rather than on the exit code, for example:

if [ -n "$(kubectl api-resources --api-group=v1.edp.epam.com -o name 2>/dev/null)" ]; then

or test the CRD directly with kubectl get crd keycloakclients.v1.edp.epam.com --ignore-not-found -o name.

Environment

Cozystack v1.6.0, tenant Kubernetes app at oidc.mode: None (chart default), no keycloak-operator package.