feat: migrate demo-ui.md from demo realm to kagenti realm#149
Merged
5 commits merged intoMar 6, 2026
Merged
Conversation
15 tasks
Migrate all GitHub Issue Agent demo files from the Keycloak "demo" realm to the shared "kagenti" realm. This aligns the demo with the platform-wide realm migration (kagenti#764) so that UI-issued tokens and demo tokens share the same issuer, enabling UI chat with AuthBridge-protected agents. Updated files: - k8s/configmaps.yaml: KEYCLOAK_REALM, TOKEN_URL, ISSUER - k8s/github-tool-deployment.yaml: ISSUER, JWKS_URL - k8s/git-issue-agent-deployment.yaml: JWKS_URI - setup_keycloak.py: default KEYCLOAK_REALM - demo-manual.md: all realm references in docs and commands Part of: rossoctl/rossoctl#767 Signed-off-by: Mariusz Sabath <mrsabath@gmail.com> Made-with: Cursor
Update all Keycloak realm references in demo-ui.md from "demo" to "kagenti" to align with the platform-wide realm migration (kagenti#764). With the UI and demos now on the same realm, the UI chat with AuthBridge-protected agents works end-to-end. The Step 8 known-limitation workaround (kagenti-extensions#147) is replaced with instructions for direct UI chat. Part of: rossoctl/rossoctl#767 Signed-off-by: Mariusz Sabath <mrsabath@gmail.com> Made-with: Cursor
The CLI test steps were obtaining the Keycloak admin token from the master realm. Now that the admin user exists in the kagenti realm with realm-admin permissions, use the kagenti realm consistently throughout the demo to avoid cross-realm dependencies. The wrong-issuer test and troubleshooting sections intentionally retain master realm references. Signed-off-by: Mariusz Sabath <mrsabath@gmail.com> Made-with: Cursor
mrsabath
force-pushed
the
feat/demo-ui-kagenti-realm
branch
from
March 5, 2026 04:01
f9efa45 to
22d2698
Compare
The Kagenti installer (rossoctl/rossoctl#851) now creates correct default ConfigMaps for all AuthBridge components: - authbridge-config with templatized kagenti realm - envoy-config with 300s timeouts and Lua filter for inbound direction Remove environments, spiffe-helper-config, and envoy-config from the demo's configmaps.yaml — only authbridge-config remains, overriding TARGET_AUDIENCE (github-tool), TARGET_SCOPES, and EXPECTED_AUDIENCE with demo-specific values. Update demo-ui.md Step 2 and demo-manual.md Step 3 to explain that only authbridge-config is overridden. Update troubleshooting sections to reference the installer's envoy-config defaults. Signed-off-by: Mariusz Sabath <mrsabath@gmail.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Keycloak only auto-assigns realm default scopes to newly created clients. The UI kagenti client was created during install before the agent audience scope existed, so it does not inherit it. Without this scope, the UI token lacks the agent SPIFFE ID in the audience claim, causing AuthBridge to reject UI chat requests with invalid audience. Explicitly add the agent-ns-sa-aud scope to the kagenti UI client after creating it as a realm default. This is a temporary workaround until the client-registration sidecar handles this automatically (rossoctl#169). Signed-off-by: Mariusz Sabath <mrsabath@gmail.com> Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
github-project-automation
Bot
moved this from Backlog
to Done
in Rossoctl Issue Prioritization
This was referenced Mar 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
demo-ui.mdfromdemotokagentikagentirealmFiles changed
demo-ui.mdrealms/demoURLs, realm table entry, ConfigMap verification, CLI test commands, expected log output, patching section JWKS_URI, troubleshooting referencesdemo-ui.md(Step 8)Part of: kagenti#767
Test plan
kagentirealm)kagentirealm tokenkagentirealm in issuer/token-exchange URLs