docs(srm): update README to clarify SRM image requirements and remove deprecated controlPaths

13. [Trying OOP without login](#13-trying-oop-without-login)

14. [How to…](#14-how-to)

15. [Troubleshooting](#15-troubleshooting)

16. [What is done and what is next](#16-what-is-done-and-what-is-next)

16. [Limits](#16-limits)

17. [Further reading](#17-further-reading)

---

| I changed `values.yaml` and nothing changed in Keycloak | The realm already existed | See [Change realm settings after install](#change-realm-settings-after-install). |

| The `organization` claim is missing | No admin set **Organization ID** for that user (expected), or the token predates the change | Set it, then wait up to 5 minutes or log in again. |

## 16. What is done and what is next

## 16. Limits

| Piece | Status |

|---|---|

| Keycloak, realms, roles, clients, generated secrets, organizations (this chart) | Done |

| Federation Manager checks partner tokens (signature, issuer, audience, scope) | In the FM code; your FM image must include it |

| Portal backend checks bearer tokens and roles | Done (audience check still to switch on) |

| Portal real login (Authorization Code + PKCE, server-side session, logout) | Next: the Portal still has a placeholder login screen |

| API products: roles on `oeg`, scope gate, provisioner client (realm import) | Done for new realms |

| API products: provisioner permissions, registration policies, later product changes | Next: a job that runs on every install and upgrade |

| OEG checks tokens and reads `organization` | Next: OEG does not check tokens yet |

| HTTPS / Ingress for Keycloak | Not yet: `http` + NodePort today; `keycloak.hostname` can already point at an HTTPS address behind your own ingress |

- Keycloak is served over `http` on a NodePort; the chart has no HTTPS or Ingress. `keycloak.hostname`

  can point at an HTTPS address behind your own ingress.

## 17. Further reading

## Release compatibility

Use the SRM image built with the SDK version SRM's `pyproject.toml` pins (2.0.0rc4). The image

Use the SRM image built with the SDK version SRM's `pyproject.toml` pins. The image

installs Helm 3.18.6. Upgrade or roll back SDK, SRM, chart and configuration together.

## What SRM needs

| `federationManager.timeout` | number | `5` | Seconds per Federation Manager call |

| `instancesMonitorInterval` | number | `30` | Seconds between probes of capability instances' runtime state (`INSTANCES_MONITOR_INTERVAL`) |

| `zoneProviderName` | string | `""` | Provider name SRM reports for its zones; empty = SRM's default (`oop-provider`) |

| `controlPaths` | list | `[]` | Retired; nonempty input fails with a migration error |

| `controlPathCredentials` | list | `[]` | Generated references to existing credential Secret mounts |

| `topology` | string | `""` | Bootstrap topology YAML (see [Bootstrap topology](#bootstrap-topology)) |

| `workloads.namespaces` | list | `[]` | Namespaces SRM may deploy workloads into (kind: `[oop-apps]`) |

## One bootstrap for control paths and topology

Put the complete SDK bootstrap in `topology`. SRM loads one

revision and derives discovery and its execution registry from it; the

`controlPaths` list is retired. Instance identity is derived from each

revision and derives discovery and its execution registry from it. Instance identity is derived from each

`control_paths[].ref`; do not repeat it in infrastructure configuration.

For the cluster SRM runs in:

Kubeconfig changes require a new SDK instance/Pod; the SDK pins the selected

profile on first use. The SDK does not resolve Secret URIs.

The chart rejects missing, duplicate or mismatched credential mounts and

retired registry values before deployment. The existing Ansible `oop-platform`

The chart rejects missing, duplicate or mismatched credential mounts before

deployment. The Ansible `oop-platform`

role can generate bootstrap and mount metadata from one operator declaration,

avoiding manual duplication of file paths. Chart rendering validates mapping;

it does not establish that remote credentials or backends work.

Bootstrap is declared topology, not backend health. SRM keeps create-missing

seeding: existing DB entries are not updated or deleted.

Changing `topology` restarts the Pod through its existing checksum annotation.

Changing `topology` restarts the Pod through its checksum annotation.

Offline chart verification: