Resource Registration - General DevOps, Routing & Authorization configuration (50h) 26/Q2

[achtsnits]

Ensure operational feasibility to enable deployment in production environments (e.g. Terrabyte)

Items will be tracked here as they come up, along with the on-demand hours spent, and accounted for against the overall estimate.

Follow-up of #129

• keycloak client and roles for eoapi are not propagated to keycloak -> see comment below

[achtsnits]

after changing some settings and mapping for the eoapi client we noticed that provider-keycloak is not reconciling anymore with error

"failed to configure the no-fork client: failed to configure the Keycloak provider: [{0 error initializing keycloak provider failed to perform initial login to Keycloak: malformed version: []}"

we then found crossplane-contrib/provider-keycloak#406 -> Keycloak 26.4 hides systemInfo from /admin/serverinfo for non-master realm admins, and the Terraform provider parses the missing version as Malformed version: []. In that thread, testing v2.8.0-rc did not fix it, and the issue was closed as upstream Terraform-provider behavior in the later comments

a workaround is described in https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/26.4/html/upgrading_guide/migration-changes

-> create a view-system client role on the eoepca realm’s realm-management client and assign it to the admin user/service account

that is something we automated for Terrabyte and must be automated for eoepca-demo as well (as soon as Keycloak is upgraded there as well)

to test we used

kubectl get secret keycloak-secret -n workspace \
  -o jsonpath='{.data.credentials}' | base64 -d > /tmp/kc-creds.json

URL="$(jq -r '.url' /tmp/kc-creds.json)"
BASE_PATH="$(jq -r '.base_path // ""' /tmp/kc-creds.json)"
REALM="$(jq -r '.realm // "master"' /tmp/kc-creds.json)"
CLIENT_ID="$(jq -r '.client_id' /tmp/kc-creds.json)"
CLIENT_SECRET="$(jq -r '.client_secret' /tmp/kc-creds.json)"

[ "$BASE_PATH" = "/" ] && BASE_PATH=""
AUTH="${URL%/}${BASE_PATH%/}"

TOKEN="$(curl -skS \
  -d grant_type=client_credentials \
  -d client_id="$CLIENT_ID" \
  --data-urlencode client_secret="$CLIENT_SECRET" \
  "$AUTH/realms/$REALM/protocol/openid-connect/token" | jq -r .access_token)"

curl -skS -H "Authorization: Bearer $TOKEN" \
  "$AUTH/admin/serverinfo" | jq '.systemInfo.version'

should return e.g. 26.5.2 (not null!)