From 774c94f85eea8357a28e23698cc932030b48a3b8 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Tue, 26 May 2026 16:09:18 -0400 Subject: [PATCH 1/5] docs(weather-agent): fix installer secret namespace in demo-ui Clarify keycloak-admin-secret lives in kagenti-system (not team1) on operator 0.2+, and point UI login to kagenti-test-user in keycloak. Fixes kagenti#1679 Signed-off-by: Mariusz Sabath --- authbridge/demos/weather-agent/demo-ui.md | 25 +++++++++-------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index 66249e2d9..e511f041d 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -103,24 +103,19 @@ You should also have: ## Installer-Provided Resources -The Kagenti installer creates everything this demo needs in the target namespace: +In **`team1`**: `authbridge-config`, `authbridge-runtime-config`, `spiffe-helper-config`, +`envoy-config`. No extra Secrets or ConfigMaps are required for this demo (outbound +passthrough; inbound JWT uses issuer/signature checks). -- **`kagenti` realm** in Keycloak -- **`keycloak-admin-secret`** Secret (Keycloak admin credentials) -- **`authbridge-config`**, **`authbridge-runtime-config`**, **`spiffe-helper-config`**, **`envoy-config`** ConfigMaps +**`keycloak-admin-secret` is not in `team1`.** Operator 0.2+ keeps it in +**`kagenti-system`** for client registration. `NotFound` in `team1` is expected: -No additional Keycloak configuration, Secrets, or ConfigMaps are required for -this demo. The weather agent uses outbound passthrough (no token exchange), and -inbound JWT validation works with signature and issuer checks alone. +```bash +kubectl get secret keycloak-admin-secret -n kagenti-system +``` -> If your Keycloak admin credentials differ from the default (`admin`/`admin`), -> update the secret: -> ```bash -> kubectl create secret generic keycloak-admin-secret -n team1 \ -> --from-literal=KEYCLOAK_ADMIN_USERNAME= \ -> --from-literal=KEYCLOAK_ADMIN_PASSWORD= \ -> --dry-run=client -o yaml | kubectl apply -f - -> ``` +UI login: secret **`kagenti-test-user`** in namespace **`keycloak`** (`admin` + password). +Realm **`kagenti`** is created by the platform installer. --- From a11c09a5d326979904f6370cc947425a9b5dc836 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Mon, 1 Jun 2026 15:02:25 -0400 Subject: [PATCH 2/5] docs(weather-agent): align troubleshooting with kagenti-system secret Address review feedback on #439: - Troubleshooting step now checks keycloak-admin-secret in kagenti-system, matching the note added earlier in the same doc (operator 0.2+). - Update stale "client-registration sidecar" wording to reference the operator's ClientRegistrationReconciler, which handles client registration in operator 0.2+. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- authbridge/demos/weather-agent/demo-ui.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index e511f041d..4caf77569 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -560,13 +560,14 @@ kubectl delete pod test-client -n team1 --ignore-not-found **Symptom:** `{"error":"invalid_client","error_description":"Invalid client or Invalid client credentials"}` **Cause:** The `keycloak-admin-secret` Secret or `authbridge-config` ConfigMap was missing -or incorrect at startup, so the client-registration sidecar couldn't register the client. +or incorrect at startup, so the operator's `ClientRegistrationReconciler` couldn't reach +Keycloak to register the client. **Fix:** ```bash -# 1. Verify the keycloak-admin-secret exists -kubectl get secret keycloak-admin-secret -n team1 +# 1. Verify the keycloak-admin-secret exists (operator 0.2+ keeps it in kagenti-system) +kubectl get secret keycloak-admin-secret -n kagenti-system # 2. Verify the authbridge-config ConfigMap has the correct realm kubectl get configmap authbridge-config -n team1 -o jsonpath='{.data.KEYCLOAK_REALM}' From 7427b76a3db1c53446c56f94a194e1ccab151627 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Mon, 1 Jun 2026 15:39:39 -0400 Subject: [PATCH 3/5] docs(weather-agent): clarify expected container count by mode The Step 3 verification claimed 2/2 with a single combined AuthBridge sidecar, which is only true for proxy-sidecar mode without SPIRE. Real installs commonly run with `kagenti.io/spire: enabled` and/or envoy-sidecar mode and see 3/3 (`agent envoy-proxy spiffe-helper`). State the expected output explicitly for the cluster-default mode and note that the count depends on AuthBridge mode + SPIRE setting. Link to the deployment guide for the full mode/label reference. Tracking the broader docs gap in kagenti/kagenti#1775. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- authbridge/demos/weather-agent/demo-ui.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index 4caf77569..8a1c277d6 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -227,7 +227,7 @@ Wait for the Shipwright build to complete and the deployment to become ready. kubectl get pods -n team1 ``` -Expected output: +Expected output (cluster default — `proxy-sidecar` mode, no SPIRE): ``` NAME READY STATUS RESTARTS AGE @@ -235,11 +235,14 @@ weather-service-58768bdb67-xxxxx 2/2 Running 0 2m weather-tool-7f8c9d6b44-yyyyy 1/1 Running 0 5m ``` -> **Note:** The agent pod shows **2/2** containers — the agent itself plus -> one combined AuthBridge sidecar (spiffe-helper is bundled inside; client -> registration is handled by the operator outside the pod). In envoy-sidecar -> mode you'll also see a `proxy-init` init container that exits after -> setting up iptables. +> **Note:** The container count depends on the AuthBridge mode and whether +> SPIRE identity is enabled — `2/2` is the cluster-default `proxy-sidecar` +> mode (`agent` + `authbridge-proxy`). With `envoy-sidecar` mode you'll see +> `agent` + `envoy-proxy` (plus a `proxy-init` init container), and with +> `kagenti.io/spire: enabled` on the workload you'll also see a +> `spiffe-helper` sidecar (so `3/3` is normal in that case). See the +> [AuthBridge deployment guide](https://github.com/kagenti/kagenti/blob/main/docs/authbridge/deployment-guide.md) +> for the full mode/label reference. ### Verify injected containers From 8dacc1787644ae1e6c46d029e7001ccb684f9a19 Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Tue, 2 Jun 2026 14:28:29 -0400 Subject: [PATCH 4/5] docs(weather-agent): align Step 3 expected output with Step 2 SPIRE default Step 2 instructs users to keep "Enable SPIRE identity" checked by default, but Step 3's expected pod output assumed SPIRE was disabled (2/2). A user following the defaults sees 3/3 and may believe the deployment is wrong. Make the Step 2-default case (proxy-sidecar + SPIRE = 3/3) the primary example, and document the no-SPIRE 2/2 case as the alternate. Apply the same alignment to the "Verify injected containers" output. Tag fenced code blocks as 'text' to satisfy markdownlint MD040. Addresses CodeRabbit review comments on demo-ui.md:236 and :245. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- authbridge/demos/weather-agent/demo-ui.md | 27 ++++++++++++++--------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index 8a1c277d6..802d4a41e 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -227,20 +227,21 @@ Wait for the Shipwright build to complete and the deployment to become ready. kubectl get pods -n team1 ``` -Expected output (cluster default — `proxy-sidecar` mode, no SPIRE): +Expected output (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity enabled): -``` +```text NAME READY STATUS RESTARTS AGE -weather-service-58768bdb67-xxxxx 2/2 Running 0 2m +weather-service-58768bdb67-xxxxx 3/3 Running 0 2m weather-tool-7f8c9d6b44-yyyyy 1/1 Running 0 5m ``` > **Note:** The container count depends on the AuthBridge mode and whether -> SPIRE identity is enabled — `2/2` is the cluster-default `proxy-sidecar` -> mode (`agent` + `authbridge-proxy`). With `envoy-sidecar` mode you'll see -> `agent` + `envoy-proxy` (plus a `proxy-init` init container), and with -> `kagenti.io/spire: enabled` on the workload you'll also see a -> `spiffe-helper` sidecar (so `3/3` is normal in that case). See the +> SPIRE identity is enabled. With Step 2's defaults — `proxy-sidecar` mode +> plus SPIRE identity — `weather-service` runs `agent` + `authbridge-proxy` +> + `spiffe-helper` (`3/3`). If you unchecked **Enable SPIRE identity**, the +> `spiffe-helper` container is absent (`2/2`). With `envoy-sidecar` mode +> you'll see `agent` + `envoy-proxy` (plus a `proxy-init` init container) +> instead of `authbridge-proxy`. See the > [AuthBridge deployment guide](https://github.com/kagenti/kagenti/blob/main/docs/authbridge/deployment-guide.md) > for the full mode/label reference. @@ -250,15 +251,21 @@ weather-tool-7f8c9d6b44-yyyyy 1/1 Running 0 5m kubectl get pod -n team1 -l app.kubernetes.io/name=weather-service -o jsonpath='{.items[0].spec.containers[*].name}' ``` -Expected (proxy-sidecar mode, the cluster default): +Expected (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity): +```text +agent authbridge-proxy spiffe-helper ``` + +Without SPIRE identity (Step 2 checkbox unchecked): + +```text agent authbridge-proxy ``` Or, in envoy-sidecar mode: -``` +```text agent envoy-proxy ``` From 189bcdb8272ea84157bb7339e20152c51b38dadd Mon Sep 17 00:00:00 2001 From: Mariusz Sabath Date: Wed, 3 Jun 2026 15:50:49 -0400 Subject: [PATCH 5/5] docs(weather-agent): correct Step 3 to combined-sidecar (2/2) layout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hai is right — on kagenti main, AuthBridge ships as a single combined sidecar image (kagenti-extensions#411). The weather-service pod is 2/2 regardless of SPIRE: spiffe-helper is bundled inside the combined image and activated per workload via SPIRE_ENABLED, not as a separate container. The deployment guide explicitly lists "1 combined sidecar" for both proxy-sidecar and envoy-sidecar modes (docs/authbridge/deployment-guide.md and charts/kagenti/values.yaml). The 3/3 separate-spiffe-helper layout I introduced in 8dacc17 described the pre-#411 / v0.6 model — wrong for main. Revert the container-count claim to 2/2 in both "Check pod status" and "Verify injected containers" sections, and update the explanatory note to match the combined-sidecar architecture. Container names returned by kubectl ... containers[*].name are 'agent authbridge-proxy' (proxy mode) or 'agent envoy-proxy' (envoy mode) regardless of SPIRE. Addresses huang195's review on PR #439. Assisted-By: Claude (Anthropic AI) Signed-off-by: Mariusz Sabath --- authbridge/demos/weather-agent/demo-ui.md | 32 +++++++++++------------ 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/authbridge/demos/weather-agent/demo-ui.md b/authbridge/demos/weather-agent/demo-ui.md index 802d4a41e..8fad5370c 100644 --- a/authbridge/demos/weather-agent/demo-ui.md +++ b/authbridge/demos/weather-agent/demo-ui.md @@ -227,21 +227,22 @@ Wait for the Shipwright build to complete and the deployment to become ready. kubectl get pods -n team1 ``` -Expected output (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity enabled): +Expected output (Step 2 defaults — `proxy-sidecar` mode): ```text NAME READY STATUS RESTARTS AGE -weather-service-58768bdb67-xxxxx 3/3 Running 0 2m +weather-service-58768bdb67-xxxxx 2/2 Running 0 2m weather-tool-7f8c9d6b44-yyyyy 1/1 Running 0 5m ``` -> **Note:** The container count depends on the AuthBridge mode and whether -> SPIRE identity is enabled. With Step 2's defaults — `proxy-sidecar` mode -> plus SPIRE identity — `weather-service` runs `agent` + `authbridge-proxy` -> + `spiffe-helper` (`3/3`). If you unchecked **Enable SPIRE identity**, the -> `spiffe-helper` container is absent (`2/2`). With `envoy-sidecar` mode -> you'll see `agent` + `envoy-proxy` (plus a `proxy-init` init container) -> instead of `authbridge-proxy`. See the +> **Note:** AuthBridge ships as a single combined sidecar image (since +> kagenti-extensions#411). `weather-service` runs `agent` + the combined +> AuthBridge sidecar — `2/2` — regardless of whether SPIRE identity is +> enabled. The `spiffe-helper` is bundled inside the combined image and +> activated per workload via `SPIRE_ENABLED` (driven by the +> `kagenti.io/spire: enabled` label); it is not a separate container. In +> `envoy-sidecar` mode the pod is still `2/2` (`agent` + the combined +> sidecar) plus a `proxy-init` init container for iptables setup. See the > [AuthBridge deployment guide](https://github.com/kagenti/kagenti/blob/main/docs/authbridge/deployment-guide.md) > for the full mode/label reference. @@ -251,24 +252,21 @@ weather-tool-7f8c9d6b44-yyyyy 1/1 Running 0 5m kubectl get pod -n team1 -l app.kubernetes.io/name=weather-service -o jsonpath='{.items[0].spec.containers[*].name}' ``` -Expected (Step 2 defaults — `proxy-sidecar` mode with SPIRE identity): - -```text -agent authbridge-proxy spiffe-helper -``` - -Without SPIRE identity (Step 2 checkbox unchecked): +Expected (Step 2 defaults — `proxy-sidecar` mode): ```text agent authbridge-proxy ``` -Or, in envoy-sidecar mode: +Or, in `envoy-sidecar` mode: ```text agent envoy-proxy ``` +The container *names* don't change with SPIRE — `spiffe-helper` runs inside +the combined sidecar, not as a separate container. + ### Check operator-managed client registration After kagenti-extensions#411 / kagenti-operator#361, client registration runs