From 4da321d0ebcee2c7174c41794f5b920d50382d6b Mon Sep 17 00:00:00 2001 From: Paolo Dettori Date: Mon, 24 Aug 2026 10:32:54 -0400 Subject: [PATCH] docs(weather-agent): drop obsolete keycloak-admin-secret guidance On operator v0.7.0 the operator registers Keycloak clients via its own SPIFFE workload identity (federated by the rossoctl-operator-client-bootstrap post-install job), not an admin username/password Secret. No keycloak-admin-secret exists in rossoctl-system (or team1) in a Helm install, so the previous verification steps sent users chasing an expected NotFound. Update the "Installer-Provided Resources" note and the "Invalid Client" troubleshooting section to verify registration via the per-workload rossoctl-keycloak-client-credentials-* Secret and the operator "client registration applied" log line instead. Closes #790 Assisted-By: Claude (Anthropic AI) Signed-off-by: Paolo Dettori --- authbridge/demos/weather-agent/demo-ui.md | 32 +++++++++++++++++------ 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index ea69794f1..c89bd6be8 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -107,13 +107,25 @@ In **`team1`**: `authbridge-config`, `authbridge-runtime-config`, `spiffe-helper `envoy-config`. No extra Secrets or ConfigMaps are required for this demo (outbound passthrough; inbound JWT uses issuer/signature checks). -**`keycloak-admin-secret` is not in `team1`.** Operator 0.2+ keeps it in -**`rossoctl-system`** for client registration. `NotFound` in `team1` is expected: +**No `keycloak-admin-secret` is required — in `team1` or `rossoctl-system`.** On the +current operator (v0.7.0) the operator registers Keycloak clients using its own **SPIFFE +workload identity** (federated into Keycloak by the `rossoctl-operator-client-bootstrap` +post-install job in the `keycloak` namespace), not an admin username/password Secret. +A `NotFound` for `keycloak-admin-secret` in **either** namespace is expected. Confirm +registration by the per-workload client credentials the operator writes instead: ```bash -kubectl get secret keycloak-admin-secret -n rossoctl-system +# One Secret per registered workload: +kubectl get secret -n team1 | grep rossoctl-keycloak-client-credentials +# ...and/or watch the operator apply registrations: +kubectl logs -n rossoctl-system deployment/rossoctl-controller-manager \ + | grep "client registration applied" | tail ``` +> Older docs (operator 0.2+) referenced a `keycloak-admin-secret` in `rossoctl-system`. +> The Helm install no longer creates or uses it; the admin credentials the bootstrap job +> needs are read from `keycloak-initial-admin` in the `keycloak` namespace. + UI login: secret **`rossoctl-test-user`** in namespace **`keycloak`** (`admin` + password). Realm **`rossoctl`** is created by the platform installer. @@ -567,15 +579,19 @@ kubectl delete pod test-client -n team1 --ignore-not-found **Symptom:** `{"error":"invalid_client","error_description":"Invalid client or Invalid client credentials"}` -**Cause:** The `keycloak-admin-secret` Secret or `authbridge-config` ConfigMap was missing -or incorrect at startup, so the operator's `ClientRegistrationReconciler` couldn't reach -Keycloak to register the client. +**Cause:** The operator's `ClientRegistrationReconciler` couldn't complete registration — +usually because the `authbridge-config` ConfigMap had the wrong realm, or the operator's +SPIFFE identity was not yet federated into Keycloak (the `rossoctl-operator-client-bootstrap` +job). On v0.7.0 the operator authenticates via its SPIFFE workload identity, so there is +**no** `keycloak-admin-secret` to check. **Fix:** ```bash -# 1. Verify the keycloak-admin-secret exists (operator 0.2+ keeps it in rossoctl-system) -kubectl get secret keycloak-admin-secret -n rossoctl-system +# 1. Confirm the operator registered a client for the workload +kubectl get secret -n team1 | grep rossoctl-keycloak-client-credentials +kubectl logs -n rossoctl-system deployment/rossoctl-controller-manager \ + | grep -iE "clientregistration|client registration applied" | tail # 2. Verify the authbridge-config ConfigMap has the correct realm kubectl get configmap authbridge-config -n team1 -o jsonpath='{.data.KEYCLOAK_REALM}'