feat: make keycloak optional by CasLubbers · Pull Request #3616 · linode/apl-core

CasLubbers · 2026-09-02T13:32:50Z

📌 Summary

🔍 Reviewer Notes

🧹 Checklist

Code is readable, maintainable, and robust.
Unit tests added/updated

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

Copilot

🟡 Changes recommended

Migration v72 currently overwrites otomi.issuer unconditionally, which can revert clusters that explicitly selected a non-default issuer.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR shifts the platform’s default OIDC issuer from Keycloak to Dex and introduces an explicit apps.keycloak.enabled flag so Keycloak can be fully optional (including gating its Helmfile releases). It also adds a migration step intended to preserve existing clusters’ behavior.

Changes:

Update schema + defaults: Dex enabled by default; otomi.issuer default becomes dex; introduce apps.keycloak.enabled (default false).
Gate Keycloak-related Helmfile releases (operator, artifacts, DB) on apps.keycloak.enabled and stop forcing Keycloak enabled via derived values.
Add migration v72 + test/fixture updates to keep pre-existing clusters on Keycloak.

Note: Since this touches helmfile.d/** and templating behavior, bin/compare.sh should be run (per repo guidance) and the observed render diffs summarized in the PR.

File summaries

File	Description
values-schema.yaml	Adds `apps.keycloak.enabled`; flips defaults to Dex-first (`dex.enabled: true`, `otomi.issuer: dex`).
values-changes.yaml	Adds migration v72 intended to keep existing clusters on Keycloak.
tests/fixtures/env/settings/versions.yaml	Bumps fixture specVersion to 72.
tests/fixtures/env/apps/keycloak.yaml	Updates fixture to include `enabled: true`.
src/cmd/migrate.test.ts	Adds a unit test for the v72 migration behavior.
helmfile.d/snippets/derived.gotmpl	Stops forcing Keycloak enabled in derived values.
helmfile.d/snippets/defaults.yaml	Updates defaults for Dex/Keycloak enablement and issuer; bumps specVersion to 72.
helmfile.d/helmfile-05.init.yaml.gotmpl	Gates Keycloak releases on `apps.keycloak.enabled`.
helmfile.d/helmfile-04.init.yaml.gotmpl	Gates Keycloak-operator releases on `apps.keycloak.enabled`.
helmfile.d/helmfile-03.databases.yaml.gotmpl	Gates Keycloak DB release on `apps.keycloak.enabled`.

Review details

Files reviewed: 10/10 changed files
Comments generated: 2
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+describe('Keycloak-optional migration (version 72)', () => {
+  it('enables Keycloak and pins the issuer for a pre-existing cluster', async () => {
+    const { changes } = load(readFileSync(join(__dirname, '../../values-changes.yaml'), 'utf-8')) as {
+      changes: Changes
+    }


svcAPLBot · 2026-09-03T12:06:28Z

Comparison of Helm chart templating output:

# raw/templates/resources.yaml

@@ spec.data @@
# external-secrets.io/v1/ExternalSecret/apl-gitea-operator/apl-gitea-operator-secret
! - one list entry removed:
- - remoteRef:
-     key: keycloak-secrets
-     property: idp_clientSecret
-   secretKey: oidcClientSecret
! + one list entry added:
+ - remoteRef:
+     key: dex-secrets
+     property: idpClientSecret
+   secretKey: oidcClientSecret

@@ spec.target.template.data.oidcEndpoint @@
# external-secrets.io/v1/ExternalSecret/apl-gitea-operator/apl-gitea-operator-secret
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

# raw/templates/resources.yaml

@@ data.oidcName @@
# v1/ConfigMap/apl-harbor-operator/apl-harbor-operator-cm
! ± value change
- keycloak
+ dex

@@ data.oidcScope @@
# v1/ConfigMap/apl-harbor-operator/apl-harbor-operator-cm
! ± value change
- openid
+ openid email profile groups

@@ spec.data @@
# external-secrets.io/v1/ExternalSecret/apl-harbor-operator/apl-harbor-operator-secret
! - one list entry removed:
- - remoteRef:
-     key: keycloak-secrets
-     property: idp_clientSecret
-   secretKey: oidcClientSecret
! + one list entry added:
+ - remoteRef:
+     key: dex-secrets
+     property: idpClientSecret
+   secretKey: oidcClientSecret

@@ spec.target.template.data.oidcEndpoint @@
# external-secrets.io/v1/ExternalSecret/apl-harbor-operator/apl-harbor-operator-secret
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

# New file added: apl-operator-apl-operator-artifacts
# argo-cd/templates/argocd-application-controller/statefulset.yaml

# argo-cd/templates/argocd-configs/argocd-cm.yaml

@@ data.oidc.config @@
! ± value change in multiline text (two inserts, one deletion)
  name: Otomi
- issuer: https://keycloak.dev.linode-apl.net/realms/otomi
+ issuer: https://dex.dev.linode-apl.net
  clientID: otomi
  clientSecret: '$oidc.clientSecret'
  requestedScopes:
    - openid
    - email
    - profile
+   - groups

# argo-cd/templates/argocd-repo-server/deployment.yaml

# argo-cd/templates/argocd-server/deployment.yaml

# argo-cd/templates/extra-manifests.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/argocd-auth-redirects
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# raw/templates/resources.yaml

@@ spec.data.0.remoteRef.key @@
# external-secrets.io/v1/ExternalSecret/argocd/argocd-oidc-secret
! ± value change
- keycloak-secrets
+ dex-secrets

@@ spec.data.0.remoteRef.property @@
# external-secrets.io/v1/ExternalSecret/argocd/argocd-oidc-secret
! ± value change
- idp_clientSecret
+ idpClientSecret

# dex/templates/deployment.yaml

@@ spec.template.spec.containers.dex.args @@
! + two list entries added:
+ - "--grpc-addr"
+ - "0.0.0.0:5557"

@@ spec.template.spec.containers.dex.ports @@
! + one list entry added:
+ - name: grpc
+   containerPort: 5557
+   protocol: TCP

# dex/templates/service.yaml

@@ spec.ports @@
! + one list entry added:
+ - name: grpc
+   port: 5557
+   targetPort: grpc
+   protocol: TCP
+   appProtocol: http

# raw/templates/resources.yaml

@@ spec.target.template.data.config.yaml @@
# external-secrets.io/v1/ExternalSecret/dex/dex-config
! ± value change in multiline text (three inserts, one deletion)
  
  
  issuer: https://dex.dev.linode-apl.net
  storage:
  
  [one line unchanged)]
  
    config:
      inCluster: true
  web:
    http: 0.0.0.0:5556
+ grpc:
+   addr: 0.0.0.0:5557
  telemetry:
    http: 0.0.0.0:5558
  oauth2:
    skipApprovalScreen: true
+   passwordConnector: local
  sessions:
    ssoSharedWithDefault: all
    cookieEncryptionKey: '{{ .sessionCookieEncryptionKey | toString }}'
  enablePasswordDB: true
  staticPasswords:
-   - email: otomi-admin@dev.linode-apl.net
+   - email: platform-admin@dev.linode-apl.net
      username: otomi-admin
      userID: apl-platform-admin
      hash: '{{ .adminPassword | bcrypt | toString }}'
      groups:
  
  [34 lines unchanged)]
  
      grantTypes:
        - authorization_code
        - refresh_token
        - password

# gitea/templates/gitea/config.yaml

@@ stringData.oauth2_client @@
# v1/Secret/gitea/gitea-inline-config
! ± value change in multiline text (one insert, one deletion)
  ACCOUNT_LINKING=disabled
  ENABLE_AUTO_REGISTRATION=true
- OPENID_CONNECT_SCOPES=openid email profile
- USERNAME=nickname
+ OPENID_CONNECT_SCOPES=openid email profile groups
+ USERNAME=name

# gitea/templates/gitea/deployment.yaml

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/harbor-auth-redirects
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/tty-auth
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

@@ spec.jwtRules.0.issuer @@
# security.istio.io/v1/RequestAuthentication/platform-auth
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

@@ spec.jwtRules.0.jwksUri @@
# security.istio.io/v1/RequestAuthentication/platform-auth
! ± value change
- http://keycloak-keycloakx-http.keycloak:8080/realms/otomi/protocol/openid-connect/certs
+ http://dex.dex.svc.cluster.local:5556/keys

# oauth2-proxy/templates/configmap.yaml

@@ data.oauth2_proxy.cfg @@
! ± value change in multiline text (three inserts, two deletions)
  
  # Defaults
  email_domains = [ "*" ]
  # Upon successful token verification, oauth2-proxy returns 200 and K8s gateway passes the request to the app route
  upstreams = [ "static://200" ]
  # Custom
  ssl_insecure_skip_verify = false
- provider = "keycloak-oidc"
+ provider = "oidc"
  whitelist_domains = [".dev.linode-apl.net","oauth2-proxy.istio-system.svc.cluster.local"]
- scope = "openid email profile"
- oidc_issuer_url = "https://keycloak.dev.linode-apl.net/realms/otomi"
+ scope = "openid email profile groups"
+ oidc_issuer_url = "https://dex.dev.linode-apl.net"
  code_challenge_method = "S256"
  insecure_oidc_allow_unverified_email = true
+ # oauth2-proxy substitutes {id_token} and calls this itself on sign-out.
+ backend_logout_url = "https://dex.dev.linode-apl.net/logout?id_token_hint={id_token}"
+ # oauth2-proxy forces the consent screen by default; Dex honours that over its own
+ # skipApprovalScreen setting, unlike Keycloak which ignores it.
+ approval_prompt = "auto"
  cookie_domains = ["console.dev.linode-apl.net","auth.dev.linode-apl.net","api.dev.linode-apl.net","tty.dev.linode-apl.net","gitea.dev.linode-apl.net","keycloak.dev.linode-apl.net","harbor.dev.linode-apl.net","argocd.dev.linode-apl.net","tekton.dev.linode-apl.net","kubeflow-pipelines.dev.linode-apl.net","alertmanager.dev.linode-apl.net","grafana.dev.linode-apl.net","prometheus.dev.linode-apl.net","oauth2-proxy.istio-system.svc.cluster.local","alertmanager-admin.dev.linode-apl.net","alertmanager-demo.dev.linode-apl.net","alertmanager-dev.dev.linode-apl.net","grafana-admin.dev.linode-apl.net","grafana-demo.dev.linode-apl.net","grafana-dev.dev.linode-apl.net","tekton-admin.dev.linode-apl.net","tekton-demo.dev.linode-apl.net","tekton-dev.dev.linode-apl.net"]
  # lax is enough for the redirect-based OIDC login and blocks cross-site delivery
  cookie_samesite = "lax"
  # set to the same as keycloak realm's accessCodeLifespan
  
  [four lines unchanged)]
  
  pass_authorization_header = true
  skip_auth_routes = "/manifest.json"
  silence_ping_logging = true
  custom_templates_dir = "/etc/oauth2-proxy"

# oauth2-proxy/templates/deployment.yaml

@@ spec.template.spec.initContainers @@
! - one list entry removed:
- - name: wait-for-keycloak
-   image: "curlimages/curl:latest"
-   args:
-   - "while [ $(curl -sw '%{http_code}' https://keycloak.dev.linode-apl.net/realms/otomi -o /dev/null) -ne 200 ]; do sleep 2; echo 'Waiting for Keycloak OIDC Issuer URL'; done"
-   command:
-   - /bin/sh
-   - "-c"
! + one list entry added:
+ - name: wait-for-oidc-issuer
+   image: "curlimages/curl:latest"
+   args:
+   - "while [ $(curl -sw '%{http_code}' https://dex.dev.linode-apl.net/.well-known/openid-configuration -o /dev/null) -ne 200 ]; do sleep 2; echo 'Waiting for OIDC Issuer URL'; done"
+   command:
+   - /bin/sh
+   - "-c"

# raw/templates/resources.yaml

@@ spec.data @@
# external-secrets.io/v1/ExternalSecret/oauth2-proxy-client-access
! - one list entry removed:
- - remoteRef:
-     key: keycloak-secrets
-     property: idp_clientSecret
-   secretKey: clientSecret
! + one list entry added:
+ - remoteRef:
+     key: dex-secrets
+     property: idpClientSecret
+   secretKey: clientSecret

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/kubeflow-pipelines
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# kube-prometheus-stack/templates/alertmanager/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# kube-prometheus-stack/templates/prometheus/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# raw/templates/resources.yaml

@@ spec.data.0.remoteRef.key @@
# external-secrets.io/v1/ExternalSecret/grafana/grafana-oidc-secret
! ± value change
- keycloak-secrets
+ dex-secrets

@@ spec.data.0.remoteRef.property @@
# external-secrets.io/v1/ExternalSecret/grafana/grafana-oidc-secret
! ± value change
- idp_clientSecret
+ idpClientSecret

# otomi-api/templates/configmap.yaml

@@ data @@
! + two map entries added:
+ AUTH_PROVIDER: dex
+ DEX_GRPC_ADDRESS: "dex.dex.svc:5557"

@@ data.SSO_ISSUER @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

@@ data.SSO_JWKS_URI @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/certs
+ https://dex.dev.linode-apl.net/keys

@@ data.VERSIONS @@
! ± value change in multiline text (one insert, one deletion)
  {
    "api": "main",
    "aplCharts": "main",
    "console": "main",
    "consoleLogin": "main",
    "core": "main",
-   "specVersion": 71,
+   "specVersion": 72,
    "tasks": "main",
    "tools": "main",
    "tty": "1.2.8"
  }

# otomi-api/templates/deployment.yaml

# otomi-api/templates/httproute.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# otomi-console/templates/httproute.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml

# team-ns/templates/isitio-tty-authn.yaml

@@ spec.jwtRules.0.issuer @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

@@ spec.jwtRules.0.jwksUri @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/certs
+ https://dex.dev.linode-apl.net/keys

# kube-prometheus-stack/charts/grafana/templates/configmap.yaml

@@ data.grafana.ini @@
! ± value change in multiline text (three inserts, three deletions)
  [analytics]
  check_for_plugin_updates = false
  check_for_updates = false
  feedback_links_enabled = false
  reporting_enabled = false
  [auth.generic_oauth]
  allow_sign_up = true
- api_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/userinfo
- auth_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/auth
+ api_url = https://dex.dev.linode-apl.net/userinfo
+ auth_url = https://dex.dev.linode-apl.net/auth
  client_id = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
  client_secret = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
  email_attribute_path = email
  enabled = true
  
  [three lines unchanged)]
  
  oauth_auto_login = true
  org_role = Admin
  role_attribute_path = contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'platform-admin') && 'Admin' || contains(groups[*], 'team-demo') && 'Editor'
  role_attribute_strict = true
- scopes = openid email profile
+ scopes = openid email profile groups
  tls_skip_verify_insecure = false
- token_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/token
+ token_url = https://dex.dev.linode-apl.net/token
  use_refresh_token = true
  [log]
  level = error
  mode = console
  
  [twelve lines unchanged)]
  
  [users]
  allow_sign_up = false
  auto_assign_org = true
  auto_assign_org_role = Viewer

# kube-prometheus-stack/charts/grafana/templates/deployment.yaml

# kube-prometheus-stack/charts/grafana/templates/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# kube-prometheus-stack/templates/alertmanager/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# team-ns/templates/isitio-tty-authn.yaml

@@ spec.jwtRules.0.issuer @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

@@ spec.jwtRules.0.jwksUri @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/certs
+ https://dex.dev.linode-apl.net/keys

# raw/templates/resources.yaml

@@ spec.data.0.remoteRef.key @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- keycloak-secrets
+ dex-secrets

@@ spec.data.0.remoteRef.property @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-demo-grafana-oidc-composite
! ± value change
- idp_clientSecret
+ idpClientSecret

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/tekton-demo
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# kube-prometheus-stack/charts/grafana/templates/configmap.yaml

@@ data.grafana.ini @@
! ± value change in multiline text (three inserts, three deletions)
  [analytics]
  check_for_plugin_updates = false
  check_for_updates = false
  feedback_links_enabled = false
  reporting_enabled = false
  [auth.generic_oauth]
  allow_sign_up = true
- api_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/userinfo
- auth_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/auth
+ api_url = https://dex.dev.linode-apl.net/userinfo
+ auth_url = https://dex.dev.linode-apl.net/auth
  client_id = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
  client_secret = $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
  email_attribute_path = email
  enabled = true
  
  [three lines unchanged)]
  
  oauth_auto_login = true
  org_role = Admin
  role_attribute_path = contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'platform-admin') && 'Admin' || contains(groups[*], 'team-dev') && 'Editor'
  role_attribute_strict = true
- scopes = openid email profile
+ scopes = openid email profile groups
  tls_skip_verify_insecure = false
- token_url = https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/token
+ token_url = https://dex.dev.linode-apl.net/token
  use_refresh_token = true
  [log]
  level = error
  mode = console
  
  [twelve lines unchanged)]
  
  [users]
  allow_sign_up = false
  auto_assign_org = true
  auto_assign_org_role = Viewer

# kube-prometheus-stack/charts/grafana/templates/deployment.yaml

# kube-prometheus-stack/charts/grafana/templates/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# kube-prometheus-stack/templates/alertmanager/route.yaml

@@ spec.rules @@
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# team-ns/templates/isitio-tty-authn.yaml

@@ spec.jwtRules.0.issuer @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi
+ https://dex.dev.linode-apl.net

@@ spec.jwtRules.0.jwksUri @@
! ± value change
- https://keycloak.dev.linode-apl.net/realms/otomi/protocol/openid-connect/certs
+ https://dex.dev.linode-apl.net/keys

# raw/templates/resources.yaml

@@ spec.data.0.remoteRef.key @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- keycloak-secrets
+ dex-secrets

@@ spec.data.0.remoteRef.property @@
# external-secrets.io/v1/ExternalSecret/apl-secrets/team-dev-grafana-oidc-composite
! ± value change
- idp_clientSecret
+ idpClientSecret

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/tekton-dev
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# raw/templates/resources.yaml

@@ spec.rules @@
# gateway.networking.k8s.io/v1/HTTPRoute/tekton-dashboard
! - one list entry removed:
- - filters:
-   - type: RequestRedirect
-     requestRedirect:
-       path:
-         type: ReplaceFullPath
-         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fkeycloak.dev.linode-apl.net%2Frealms%2Fotomi%2Fprotocol%2Fopenid-connect%2Flogout%3Fpost_logout_redirect_uri%3Dhttps%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart%26client_id%3Dotomi
-       statusCode: 302
-   matches:
-   - path:
-       type: Exact
-       value: /platform-logout
! + one list entry added:
+ - filters:
+   - type: RequestRedirect
+     requestRedirect:
+       path:
+         type: ReplaceFullPath
+         replaceFullPath: /oauth2/sign_out?rd=https%3A%2F%2Fconsole.dev.linode-apl.net%2Foauth2%2Fstart
+       statusCode: 302
+   matches:
+   - path:
+       type: Exact
+       value: /platform-logout

# values-repo.yaml

@@ apps.keycloak @@
! + one map entry added:
+ enabled: true

@@ versions.specVersion @@
! ± value change
- 71
+ 72

Copilot AI lite review requested due to automatic review settings September 2, 2026 13:32

CasLubbers requested review from Ani1357, ferruhcihan, j-zimnowoda and merll as code owners September 2, 2026 13:32

Copilot started reviewing on behalf of CasLubbers September 2, 2026 13:33 View session

Copilot AI reviewed Sep 2, 2026

View reviewed changes

merll approved these changes Sep 3, 2026

View reviewed changes

Comment thread values-changes.yaml

CasLubbers force-pushed the APL-2076 branch from 4150114 to 5729886 Compare September 3, 2026 11:15

CasLubbers added 5 commits September 3, 2026 14:04

feat: make keycloak optional

a6b2336

fix: set platform-admin email correctly

5c56c08

fix: creation of platform-admin-credentials

475be4d

fix: add AUTH_PROVIDER to api

a32139f

fix: harbor login

a69fd0a

CasLubbers force-pushed the APL-2076 branch from 78f3c59 to a69fd0a Compare September 3, 2026 12:05

CasLubbers added 2 commits September 3, 2026 16:08

fix: enable grpc

7ac2a95

fix: gitea username claim

4a45105

Navigation Menu

Uh oh!

feat: make keycloak optional - #3616

feat: make keycloak optional#3616
CasLubbers wants to merge 7 commits into
APL-2075from
APL-2076

CasLubbers commented Sep 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

svcAPLBot commented Sep 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

CasLubbers commented Sep 2, 2026

📌 Summary

🔍 Reviewer Notes

🧹 Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

svcAPLBot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

svcAPLBot commented Sep 3, 2026 •

edited

Loading