-
Notifications
You must be signed in to change notification settings - Fork 29
NO-JIRA: feat(doc) Adding initial documentation for dev-setup of Keycloak V1 token-exchange for ACM #114
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
|
@matzew: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
|
||
| This command performs the following: | ||
|
|
||
| 1. Enables `TechPreviewNoUpgrade` feature gate (required for OIDC) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add some kind of warning here? This flag does break upgrades (also on 4.20+ I think the OIDC is no longer tech preview which we handle here:
| EXTERNAL_OIDC_ENABLED=$(oc get featuregate cluster -o json 2>/dev/null | jq -r '.status.featureGates[0].enabled[] | select(.name == "ExternalOIDC") | .name' 2>/dev/null || echo "") |
I saw the warning as well below, maybe we can just refer to that warning?
docs/openshift/acm_keycloak_setup.md
Outdated
| Authorize: https://keycloak-.../realms/hub/protocol/openid-connect/auth | ||
| ``` | ||
|
|
||
| ## Step 2: Generate MCP Server Configuration |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this come after registering the managed clusters?
docs/openshift/acm_keycloak_setup.md
Outdated
| - Sets up OIDC clients | ||
|
|
||
| 3. **Managed Cluster OIDC Setup**: | ||
| - Enables `TechPreviewNoUpgrade` feature gate |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's add the same warning here (and maybe somewhere above)
…oken-exchange for ACM Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>
b32eb56 to
81a77b7
Compare
|
@matzew: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Cali0707
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
/retest-required
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Cali0707, matzew The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest |
as per title