Remove enabled condition from keycloak-add-client-scope unit
What does this MR do and why?
This MR was raised to fix the issue that was raised under #1889 (closed). It simply removes the dependency from flux-webui in the enabled_conditions of keycloak-add-client-scope unit.
After doing some digging, it looks like the flux-webui unit is indeed using the groups scope that is created by the keycloak-add-client-scope unit. However, Neuvector-init unit has a dependency on keycloak-add-client-scope:
neuvector-init:
info:
description: sets up Neuvector prerequisites
details: |
it generates namespace, certificate, admin password, policy exception for using latest tag images (required for the pod managing the database of vulnerabilities since this DB is updated often)
internal: true
unit_templates:
- base-deps
enabled_conditions:
- '{{ tuple . "neuvector" | include "unit-enabled" }}'
depends_on:
sylva-ca: true
vault: true
vault-config-operator: true
kyverno: true
keycloak-add-client-scope: true
keycloak-oidc-external-secrets: true
This should work regardless of the status of the flux-webui unit, therefore removing the dependency in the unit where the scope is added would be the right choice. I'm not 100% sure of how the groups scope is being used by Neuvector and if it is really needed??
Either way, regardless or not we are choosing to enable flux-webui unit or to use the groups scope, the simple existence of the scope will have no impact, since it might be used by upcoming units that are supporting Keycloak integration.
Related reference(s)
Closes #1889 (closed)
Test coverage
This was tested in a CAPO environment with both units (Harbor and Neuvector) enabled and flux-webui disabled. Everything seems to be working as expected.