keycloak user authentication

[yogananth-subramanian]

This patch enabled user authentication using keycloak.

[yogananth-subramanian]

/hold

[yogananth-subramanian]

Hello @pmacik The hard-coded password references have been removed, and the keycloak user password is now stored in a secret for reference.

[pmacik]

@yogananth-subramanian Your changes do enable the keycloak authentication all the time. IMHO, it would be useful to have a means to disabe the keycloak authentication feature. So that we can still have the original behavior (un-authenticated) available. For example, via means of an environment variable such as
KEYCLOAK_AUTHENTICATION_DISABLED with false (or not set, at all) as the default value.

If it is set to true then the framework would behave as it is now in all of it's phases (setup, test, collect-results). When set to false (or not set, at all), the changes in this PR would be in effect.

This would also enable us to measure the authentication's own overhead.

Thanks!

[pmacik]

@yogananth-subramanian A best-practice advice: As it is a secret, it should not be put into the container spec as plain text. You should put it into a Secret resource and use the same .valueFrom.secretKeyRef approach as shown in case of CLIENT_SECRET variable above.

[yogananth-subramanian]

Thanks @pmacik for the review, agree with your comment. Have fixed it in the latest commit, have moved it to a secret.

[yogananth-subramanian]

Hello @pmacik , thanks for your review.
In the latest commit, have added the option/flag for user authentication using keycloak in backstage setup and in locust mvp test.
This is done by setting environment variable AUTH_PROVIDER to keycloak.
export AUTH_PROVIDER=keycloak

@yogananth-subramanian Your changes do enable the keycloak authentication all the time. IMHO, it would be useful to have a means to disabe the keycloak authentication feature. So that we can still have the original behavior (un-authenticated) available. For example, via means of an environment variable such as KEYCLOAK_AUTHENTICATION_DISABLED with false (or not set, at all) as the default value.

If it is set to true then the framework would behave as it is now in all of it's phases (setup, test, collect-results). When set to false (or not set, at all), the changes in this PR would be in effect.

This would also enable us to measure the authentication's own overhead.

Thanks!

[jhutar]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhutar, yogananth-subramanian

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jhutar,yogananth-subramanian]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment