Skip to content

✨ Add auth settings. #581

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jortel wants to merge 2 commits into
base: main
Choose a base branch
from
+47 −9
Open

✨ Add auth settings. #581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d8bfe32
:sparkles: Add auth settings.
jortel Jun 29, 2026
6a2eed1
checkpoint
jortel Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 20 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,8 +91,6 @@ NAME READY STATUS
c4af2f0f9eab63b6ac49c81b0e517eb37c2efe1bb2ede02e8642cd--1-ghq 0/1 Completed 0 134m
konveyor-tackle-rm6jb 1/1 Running 0 134m
tackle-hub-6b6ff674dd-c6xbr 1/1 Running 0 130m
tackle-keycloak-postgresql-57f5c44bcc-r9w9s 1/1 Running 0 131m
tackle-keycloak-sso-c65cd79bf-6j4xr 1/1 Running 0 130m
tackle-operator-6b65fccb7f-q9lpf 1/1 Running 0 133m
tackle-ui-5f694bddcb-scbh5 1/1 Running 0 130m
```
Expand Down Expand Up @@ -137,30 +135,44 @@ If operator defaults need to be altered, the Tackle CR spec can be customized to

Name | Default | Description
--- | --- | ---
feature_auth_required | true | Enable keycloak auth or false (single user/noauth)
feature_auth_required | true | Require authentication for UI and Hub API (true) or allow unauthenticated access (false)
idp_primary | N/A | Set to true to mark auto-discovered IdentityProvider as primary (automatically redirects users to IdP for authentication)
feature_isolate_namespace | true | Enable namespace isolation via network policies
feature_analysis_archiver | true | If enabled, automatically archives old analysis reports when a new one is created
rwx_supported: | true | Whether or not RWX volumes are supported in the cluster
hub_database_volume_size | 5Gi | Size requested for Hub database volume
hub_bucket_volume_size | 100gi | Size requested for Hub bucket volume
keycloak_database_data_volume_size | 1Gi | Size requested for Keycloak DB volume
cache_data_volume_size | 100Gi | Size requested for Tackle Cache volume
Comment on lines 142 to 145

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Fix the CR setting names and quantity typo.

rwx_supported: includes a trailing :, and hub_bucket_volume_size is documented as 100gi. Both are copy/paste hazards: the first is not the actual field name, and the second uses the wrong Kubernetes quantity suffix casing.

Proposed doc fix 
-rwx_supported: | true | Whether or not RWX volumes are supported in the cluster
-hub_bucket_volume_size | 100gi | Size requested for Hub bucket volume
+rwx_supported | true | Whether RWX volumes are supported in the cluster
+hub_bucket_volume_size | 100Gi | Size requested for Hub bucket volume
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
rwx_supported: | true | Whether or not RWX volumes are supported in the cluster
hub_database_volume_size | 5Gi | Size requested for Hub database volume
hub_bucket_volume_size | 100gi | Size requested for Hub bucket volume
keycloak_database_data_volume_size | 1Gi | Size requested for Keycloak DB volume
cache_data_volume_size | 100Gi | Size requested for Tackle Cache volume
rwx_supported | true | Whether RWX volumes are supported in the cluster
hub_database_volume_size | 5Gi | Size requested for Hub database volume
hub_bucket_volume_size | 100Gi | Size requested for Hub bucket volume
cache_data_volume_size | 100Gi | Size requested for Tackle Cache volume
🧰 Tools
🪛 LanguageTool

[style] ~142-~142: Consider shortening this phrase to just ‘whether’, unless you mean ‘regardless of whether’.
Context: ... one is created rwx_supported: | true | Whether or not RWX volumes are supported in the cluste...

(WHETHER)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 142 - 145, Update the README documentation entries
for the CR settings so the field name in the RWX row matches the actual setting
without the trailing colon, and correct the Kubernetes quantity casing for
hub_bucket_volume_size to use the proper suffix. Make the fix in the README
settings table where rwx_supported and hub_bucket_volume_size are listed so the
documented names and values align with the real config fields.

cache_storage_class | N/A | Storage class requested for Tackle Cache volume
hub_bucket_storage_class | N/A | Storage class requested for Tackle Hub Bucket volume
rwo_storage_class | N/A | Storage class requested for RWO database volumes
hub_apikey_lifespan | 87600 (hours) | API key lifespan in hours (default: 10 years)
hub_auth_cache_lifespan | 5 (minutes) | Auth cache lifespan in minutes
hub_ldap_auth_lifespan | 5 (minutes) | LDAP auth lifespan in minutes
hub_oidc_token_lifespan | 300 (seconds) | OIDC token lifespan in seconds (default: 5 minutes)
hub_oidc_refresh_token_lifespan | 172800 (seconds) | OIDC refresh token lifespan in seconds (default: 2 days)
hub_oidc_key_rotation | 90 (days) | OIDC key rotation period in days

## Tackle CR Customize Settings

Custom settings can be applied by editing the `Tackle` CR.

`oc edit tackle -n <your-tackle-namespace>`

## Keycloak Auth
If `feature_auth_required` is enabled keycloak will be installed and a random password will be generated.
## Authentication

To view these credentials:
When `feature_auth_required` is set to `true` (the default), both the UI and Hub API require authentication. The operator will automatically detect and configure an IdentityProvider CR for any existing Keycloak (SSO) or Red Hat Build of Keycloak (RHBK) deployment found in the namespace.

If you have a Keycloak/RHBK deployment and need to access its admin credentials:
`oc -n konveyor-tackle extract secret/tackle-keycloak-sso --to=-`
Comment on lines +166 to 167

@coderabbitai coderabbitai Bot Jun 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Remove the stale operator-managed Keycloak secret command.

This still tells users to extract secret/tackle-keycloak-sso from konveyor-tackle, which contradicts the README’s updated “Keycloak is no longer managed by the operator” story and will mislead users with an external IdP.

Proposed doc fix 
-If you have a Keycloak/RHBK deployment and need to access its admin credentials:
-`oc -n konveyor-tackle extract secret/tackle-keycloak-sso --to=-`
+If you need admin credentials for an external Keycloak/RHBK deployment, retrieve them from the secret or credential source used by that deployment.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
If you have a Keycloak/RHBK deployment and need to access its admin credentials:
`oc -n konveyor-tackle extract secret/tackle-keycloak-sso --to=-`
If you need admin credentials for an external Keycloak/RHBK deployment, retrieve them from the secret or credential source used by that deployment.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 166 - 167, The README still includes an outdated
operator-managed Keycloak secret extraction command that conflicts with the
external IdP guidance. Remove the `oc -n konveyor-tackle extract
secret/tackle-keycloak-sso --to=-` instruction from the Keycloak/RHBK admin
credentials section, and update the surrounding text in that README section to
reflect that Keycloak is no longer managed by the operator.


To configure the auto-discovered IdentityProvider as the primary authentication method (automatically redirect users to the IdP):
```yaml
spec:
feature_auth_required: true
idp_primary: true
```

## Enable KAI (Solution Server)

KAI is an optional, experimental “solution server” that integrates with the Hub. To enable it:
Expand Down Expand Up @@ -260,15 +272,14 @@ The following table shows popular provider/model combinations (not exhaustive):

## Konveyor Storage Requirements

Konveyor requires a total of 4 persistent volumes (PVs): 2 RWO and 2 RWX. When
Konveyor requires a total of 3 persistent volumes (PVs): 1 RWO and 2 RWX. When
`kai_solution_server_enabled: true` is enabled, an additional RWO volume is required
for the Kai database.

Name | Default Size | Access Mode | Description
--- | --- | --- | ---
hub database | 5Gi | RWO | Hub DB
hub bucket | 100Gi | RWX | Hub file storage
keycloak postgresql | 1Gi | RWO | Keycloak backend DB
cache | 100Gi | RWX | cache repository
kai database | 5Gi | RWO | Kai DB (when kai_solution_server_enabled: true)

Expand Down
3 changes: 3 additions & 0 deletions roles/tackle/templates/customresource-identityprovider.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,6 @@ spec:
- openid
- profile
- email
{% if idp_primary is defined %}
primary: {{ idp_primary | bool }}
{% endif %}
24 changes: 24 additions & 0 deletions roles/tackle/templates/deployment-hub.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,30 @@ spec:
secretKeyRef:
name: {{ hub_secret_name }}
key: apikey-secret
{% if hub_apikey_lifespan is defined %}
- name: APIKEY_LIFESPAN
value: "{{ hub_apikey_lifespan }}"
{% endif %}
{% if hub_auth_cache_lifespan is defined %}
- name: AUTH_CACHE_LIFESPAN
value: "{{ hub_auth_cache_lifespan }}"
{% endif %}
{% if hub_ldap_auth_lifespan is defined %}
- name: LDAP_AUTH_LIFESPAN
value: "{{ hub_ldap_auth_lifespan }}"
{% endif %}
{% if hub_oidc_token_lifespan is defined %}
- name: OIDC_TOKEN_LIFESPAN
value: "{{ hub_oidc_token_lifespan }}"
{% endif %}
{% if hub_oidc_refresh_token_lifespan is defined %}
- name: OIDC_REFRESH_TOKEN_LIFESPAN
value: "{{ hub_oidc_refresh_token_lifespan }}"
{% endif %}
{% if hub_oidc_key_rotation is defined %}
- name: OIDC_KEY_ROTATION
value: "{{ hub_oidc_key_rotation }}"
{% endif %}
{% if kai_llm_proxy_enabled|bool %}
- name: LLM_PROXY_URL
value: "{{ kai_llm_proxy_internal_url }}"
Expand Down
Loading