Skip to content

fix: create missing Keycloak and SPIRE operand CRs in setup-kagenti.sh#105

Draft
usize wants to merge 1 commit into
sallyom:mainfrom
usize:fix/setup-kagenti-missing-crs
Draft

fix: create missing Keycloak and SPIRE operand CRs in setup-kagenti.sh#105
usize wants to merge 1 commit into
sallyom:mainfrom
usize:fix/setup-kagenti-missing-crs

Conversation

@usize

@usize usize commented Apr 6, 2026

Copy link
Copy Markdown

Summary

  • Adds creation of the Keycloak CR (KeycloakRealmImport) and SPIRE operand CRs (ClusterSPIFFEID, SPIREServer entries) that were missing from setup-kagenti.sh
  • Without these CRs, the Kagenti deployment is incomplete — Keycloak realm import doesn't run and SPIRE federation isn't configured
  • Includes wait/retry logic for CRD availability before applying the CRs

Fixes #95

Test plan

  • npm run build passes
  • npm test passes (277/277)
  • Verify CRs are created correctly on a live OpenShift cluster

Generated with agent.sh

setup-kagenti.sh installs kagenti-deps with --no-hooks which skips
Keycloak CR creation. It also never creates the ZTWIM/SPIRE operand CRs
needed for the SPIRE stack to function.

Add _apply_keycloak_cr() to directly apply the Keycloak CR
(k8s.keycloak.org/v2alpha1) after _apply_kagenti_deps_hook_resources in
both the fresh install and upgrade paths.

Add a new Step 5 after the kagenti chart install to create SPIRE operand
CRs: ZeroTrustWorkloadIdentityManager, SpireServer, SpireAgent,
SpiffeCSIDriver, and SpireOIDCDiscoveryProvider. Waits for SPIRE agents
to reach Running state before proceeding.

Fixes sallyom#95

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

setup-kagenti.sh skips Keycloak CR and SPIRE operand CRs, leaving platform non-functional

1 participant