Remove enabled condition from keycloak-add-client-scope unit

What does this MR do and why?

This MR was raised to fix the issue that was raised under #1889 (closed). It simply removes the dependency from flux-webui in the enabled_conditions of keycloak-add-client-scope unit.

After doing some digging, it looks like the flux-webui unit is indeed using the groups scope that is created by the keycloak-add-client-scope unit. However, Neuvector-init unit has a dependency on keycloak-add-client-scope:

neuvector-init:
    info:
      description: sets up Neuvector prerequisites
      details: |
        it generates namespace, certificate, admin password, policy exception for using latest tag images (required for the pod managing the database of vulnerabilities since this DB is updated often)
      internal: true
    unit_templates:
    - base-deps
    enabled_conditions:
    - '{{ tuple . "neuvector" | include "unit-enabled" }}'
    depends_on:
      sylva-ca: true
      vault: true
      vault-config-operator: true
      kyverno: true
      keycloak-add-client-scope: true
      keycloak-oidc-external-secrets: true

This should work regardless of the status of the flux-webui unit, therefore removing the dependency in the unit where the scope is added would be the right choice. I'm not 100% sure of how the groups scope is being used by Neuvector and if it is really needed??

Either way, regardless or not we are choosing to enable flux-webui unit or to use the groups scope, the simple existence of the scope will have no impact, since it might be used by upcoming units that are supporting Keycloak integration.

Related reference(s)

Closes #1889 (closed)

Test coverage

This was tested in a CAPO environment with both units (Harbor and Neuvector) enabled and flux-webui disabled. Everything seems to be working as expected.

Merge request reports

Loading