Skip to content

Feat: Keycloak bootstrap — operand infra and realm import #412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ChristianZaccaria wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Feat: Keycloak bootstrap — operand infra and realm import #412

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f138b3
feat: Keycloak bootstrap — operand infra and realm import
ChristianZaccaria Jun 8, 2026
c6ccab1
fix: generate DB password from crypto/rand, source via secretKeyRef, …
ChristianZaccaria Jun 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions charts/kagenti-operator/templates/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,10 +21,19 @@ rules:
resources:
- endpoints
- namespaces
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- ""
Expand Down Expand Up @@ -128,8 +137,18 @@ rules:
- apps
resources:
- deployments
verbs:
- get
- list
- patch
- update
- watch
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- create
- get
- list
- patch
Expand Down Expand Up @@ -185,13 +204,26 @@ rules:
verbs:
- get
- list
- apiGroups:
- k8s.keycloak.org
resources:
- keycloakrealmimports
- keycloaks
verbs:
- create
- get
- list
- patch
- update
- apiGroups:
- route.openshift.io
resources:
- routes
verbs:
- create
- get
- list
- update
- apiGroups:
- operator.tekton.dev
resources:
Expand Down
13 changes: 13 additions & 0 deletions kagenti-operator/cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,19 @@ func main() {
setupLog.Info("OTel collector bootstrap enabled")
}

keycloakBootstrap := &bootstrap.KeycloakBootstrapRunnable{

@cwiklik cwiklik Jun 8, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

must-fix: The Keycloak bootstrap is registered unconditionally — every other bootstrap here (MLflow, OTel) is behind an if enable… gate. Combined with the fatal Postgres path (see keycloak.go), this crash-loops the operator on any cluster without a pre-existing keycloak namespace — exactly the E2E failure (namespaces "keycloak" not found → problem running manager → exit, ×6). Gate this behind a feature flag (e.g. --enable-keycloak-bootstrap, default off).

@ChristianZaccaria ChristianZaccaria Jun 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a namespace check at top of Start() on the KeycloakBootstrapRunnable. I'm thinking of skip adding a flag since Keycloak is a core Kagenti dependency, but happy to add --enable-keycloak-bootstrap if the team prefers explicit opt-in.

Client: mgr.GetClient(),
APIReader: mgr.GetAPIReader(),
Namespace: keycloakAdminSecretNamespace,
Realm: keycloakRealm,
KeycloakPublicURL: keycloakPublicURL,
Log: ctrl.Log.WithName("bootstrap"),
}
if err := mgr.Add(keycloakBootstrap); err != nil {
setupLog.Error(err, "unable to add Keycloak bootstrap runnable")
os.Exit(1)
}

if enableAuthbridgeConfig {
if err = (&controller.AuthbridgeConfigReconciler{
Client: mgr.GetClient(),
Expand Down
27 changes: 26 additions & 1 deletion kagenti-operator/config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,8 +56,10 @@ rules:
resources:
- services
verbs:
- create
- get
- list
- update
- watch
- apiGroups:
- agent.kagenti.dev
Expand Down Expand Up @@ -117,7 +119,6 @@ rules:
resources:
- daemonsets
- deployments
- statefulsets
verbs:
- get
- list
Expand All @@ -131,6 +132,17 @@ rules:
- statefulsets/finalizers
verbs:
- update
- apiGroups:
- apps
resources:
- statefulsets
verbs:
- create
- get
- list
- patch
- update
- watch
- apiGroups:
- cert-manager.io
resources:
Expand All @@ -140,6 +152,17 @@ rules:
- get
- list
- watch
- apiGroups:
- k8s.keycloak.org
resources:
- keycloakrealmimports
- keycloaks
verbs:
- create
- get
- list
- patch
- update
- apiGroups:
- mlflow.opendatahub.io
resources:
Expand Down Expand Up @@ -208,5 +231,7 @@ rules:
resources:
- routes
verbs:
- create
- get
- list
- update
Loading
Loading