Skip to content

Commit b407cac

Browse files
myasnikovdaniilmyasnikovdaniil
committed
test(e2e): set keycloakInternalUrl when enabling OIDC
The dashboard gatekeeper (oauth2-proxy) does OIDC discovery against the external host at container startup. The e2e sandbox uses host=example.org which does not resolve, so the auth-proxy crashloops: Get "https://keycloak.example.org/realms/cozy/.well-known/openid-configuration": dial tcp: lookup keycloak.example.org: no such host Under Flux v2.8 kstatus the gatekeeper Deployment then flips to 'Failed' (rather than the pre-v2.8 'InProgress') and stalls the cozy-dashboard/dashboard HelmRelease, which in turn blocks cozy-fluxcd/flux-plunger via dependsOn. Previous runs masked this with an unrelated ImagePullBackOff on cozy-dashboard-console; with the console image fixed the OIDC discovery failure now surfaces. packages/core/platform/values.yaml:194-198 already declares authentication.oidc.keycloakInternalUrl. When set, the dashboard chart (packages/system/dashboard/templates/gatekeeper.yaml:59-66) renders --skip-oidc-discovery plus explicit redeem/jwks/validate/ backend-logout URLs pointing at the in-cluster keycloak Service. Browser-facing redirect-url and login-url stay on the external host (they are not exercised by the e2e flow). The patch sets the value alongside oidc.enabled in the same kubectl-patch so the configmap and gatekeeper rollout happen in one reconcile pass. Observed on CI run 26142986969 (PR #2619). Signed-off-by: Myasnikov Daniil <[email protected]> (cherry picked from commit 5915a57)
1 parent f4a7d6f commit b407cac

1 file changed

Lines changed: 7 additions & 1 deletion

File tree

‎hack/e2e-install-cozystack.bats‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,13 @@ EOF
181181
}
182182

183183
@test "Keycloak OIDC stack is healthy" {
184-
kubectl patch package cozystack.cozystack-platform --type merge -p '{"spec":{"components":{"platform":{"values":{"authentication":{"oidc":{"enabled":true}}}}}}}'
184+
# keycloakInternalUrl makes oauth2-proxy skip OIDC discovery and route
185+
# backend calls (token/jwks/userinfo/logout) through the in-cluster
186+
# keycloak Service. Without it the dashboard gatekeeper crashloops on
187+
# DNS lookup of keycloak.example.org -- the e2e host placeholder does
188+
# not resolve, and under Flux v2.8 kstatus the gatekeeper Deployment
189+
# then flips to Failed and stalls the dashboard HelmRelease.
190+
kubectl patch package cozystack.cozystack-platform --type merge -p '{"spec":{"components":{"platform":{"values":{"authentication":{"oidc":{"enabled":true,"keycloakInternalUrl":"http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy"}}}}}}}'
185191

186192
timeout 120 sh -ec 'until kubectl get hr -n cozy-keycloak keycloak keycloak-configure keycloak-operator >/dev/null 2>&1; do sleep 1; done'
187193
kubectl wait hr/keycloak hr/keycloak-configure hr/keycloak-operator -n cozy-keycloak --timeout=10m --for=condition=ready

0 commit comments

Comments
 (0)