chore(keycloak): address review + lint after rebase

- Extract labelPartOf/labelManagedBy/labelManagedByValue constants so the
  import-secret labels stop tripping goconst (4th occurrence of the label
  keys). Fixes the lint failure blocking CI.
- Instrument RenderKeycloakDefaults with an OTel span and thread ctx through
  from InstallFoundationalServices, per the pkg/ instrumentation convention.
- Render with missingkey=error so a stray template field fails loudly instead
  of emitting "<no value>" into the realm config; add a guard assertion.
- Expand TestRenderKeycloakDefaults to cover the security-relevant scalars
  (sslRequired, registrationAllowed, bruteForceProtected), the realm roles,
  the multivalued groups-mapper flag, the argocd client flags, and webOrigins.
- Drop the dead doc path from keycloak_defaults.yaml; point at #154.

Author: viniciusdc

pkg/argocd/foundational.go

@@ -32,6 +32,14 @@ const (
 
 	// NebariFoundationalPartOf is the value of the app.kubernetes.io/part-of label for foundational resources.
 	NebariFoundationalPartOf = "nebari-foundational"
+
+	// labelPartOf and labelManagedBy are the standard Kubernetes recommended
+	// label keys applied to foundational resources NIC creates.
+	labelPartOf    = "app.kubernetes.io/part-of"
+	labelManagedBy = "app.kubernetes.io/managed-by"
+
+	// labelManagedByValue marks resources as managed by NIC.
+	labelManagedByValue = "nebari-infrastructure-core"
 )
 
 // FoundationalConfig holds configuration for foundational services
@@ -147,7 +155,7 @@ func InstallFoundationalServices(ctx context.Context, cfg *config.NebariConfig,
 		if domain == "" {
 			domain = "nebari.local"
 		}
-		importContent, err := RenderKeycloakDefaults(TemplateData{Domain: domain})
+		importContent, err := RenderKeycloakDefaults(ctx, TemplateData{Domain: domain})
 		if err != nil {
 			span.RecordError(err)
 			return fmt.Errorf("failed to render keycloak-config-cli defaults: %w", err)
@@ -304,8 +312,8 @@ func createKeycloakSecrets(ctx context.Context, client kubernetes.Interface, key
 				Name:      "nebari-realm-admin-credentials",
 				Namespace: namespace,
 				Labels: map[string]string{
-					"app.kubernetes.io/part-of":    NebariFoundationalPartOf,
-					"app.kubernetes.io/managed-by": "nebari-infrastructure-core",
+					labelPartOf:    NebariFoundationalPartOf,
+					labelManagedBy: labelManagedByValue,
 				},
 			},
 			Type: corev1.SecretTypeOpaque,
@@ -325,8 +333,8 @@ func createKeycloakSecrets(ctx context.Context, client kubernetes.Interface, key
 				Name:      "argocd-oidc-client-secret",
 				Namespace: namespace,
 				Labels: map[string]string{
-					"app.kubernetes.io/part-of":    NebariFoundationalPartOf,
-					"app.kubernetes.io/managed-by": "nebari-infrastructure-core",
+					labelPartOf:    NebariFoundationalPartOf,
+					labelManagedBy: labelManagedByValue,
 				},
 			},
 			Type: corev1.SecretTypeOpaque,
@@ -357,8 +365,8 @@ func createKeycloakImportSecret(ctx context.Context, client kubernetes.Interface
 			Name:      KeycloakImportSecretName,
 			Namespace: KeycloakDefaultNamespace,
 			Labels: map[string]string{
-				"app.kubernetes.io/part-of":    NebariFoundationalPartOf,
-				"app.kubernetes.io/managed-by": "nebari-infrastructure-core",
+				labelPartOf:    NebariFoundationalPartOf,
+				labelManagedBy: labelManagedByValue,
 			},
 		},
 		Type: corev1.SecretTypeOpaque,
@@ -379,8 +387,8 @@ func createLandingPageSecrets(ctx context.Context, client kubernetes.Interface,
 			Name:      NebariLandingRedisSecretName,
 			Namespace: namespace,
 			Labels: map[string]string{
-				"app.kubernetes.io/part-of":    NebariFoundationalPartOf,
-				"app.kubernetes.io/managed-by": "nebari-infrastructure-core",
+				labelPartOf:    NebariFoundationalPartOf,
+				labelManagedBy: labelManagedByValue,
 			},
 		},
 		Type: corev1.SecretTypeOpaque,

pkg/argocd/keycloak_defaults.go

@@ -2,9 +2,12 @@ package argocd
 
 import (
 	"bytes"
+	"context"
 	_ "embed"
 	"fmt"
 	"text/template"
+
+	"go.opentelemetry.io/otel"
 )
 
 // keycloakDefaultsRaw is the default keycloak-config-cli input for the nebari
@@ -30,13 +33,23 @@ const (
 // supplied TemplateData. Only the Domain field is substituted today (used
 // to build the argocd client's redirect URI); future fields can be wired
 // in as the schema grows.
-func RenderKeycloakDefaults(data TemplateData) ([]byte, error) {
-	tmpl, err := template.New("keycloak_defaults.yaml").Parse(string(keycloakDefaultsRaw))
+//
+// missingkey=error makes a stray template field (e.g. a future {{ .Typo }})
+// fail loudly here rather than silently emitting "<no value>" into the realm
+// config, where it would surface only as a misconfigured Keycloak at runtime.
+func RenderKeycloakDefaults(ctx context.Context, data TemplateData) ([]byte, error) {
+	tracer := otel.Tracer("nebari-infrastructure-core")
+	_, span := tracer.Start(ctx, "argocd.RenderKeycloakDefaults")
+	defer span.End()
+
+	tmpl, err := template.New("keycloak_defaults.yaml").Option("missingkey=error").Parse(string(keycloakDefaultsRaw))
 	if err != nil {
+		span.RecordError(err)
 		return nil, fmt.Errorf("parse keycloak defaults template: %w", err)
 	}
 	var buf bytes.Buffer
 	if err := tmpl.Execute(&buf, data); err != nil {
+		span.RecordError(err)
 		return nil, fmt.Errorf("render keycloak defaults: %w", err)
 	}
 	return buf.Bytes(), nil

pkg/argocd/keycloak_defaults.yaml

@@ -1,8 +1,8 @@
 # Default keycloak-config-cli input for the nebari realm.
 #
-# Phase 1a of the declarative Keycloak configuration approach (see
-# docs/superpowers/specs/2026-03-12-declarative-keycloak-config-design.md).
-# This file is embedded into the NIC binary via go:embed (see
+# Phase 1a of the declarative Keycloak configuration approach proposed in
+# nebari-infrastructure-core#154. This file is embedded into the NIC binary
+# via go:embed (see
 # keycloak_defaults.go), rendered with TemplateData at deploy time, and
 # written verbatim to the in-cluster Secret `keycloak-config-import`. The
 # kcc Job mounts that Secret read-only and applies the file against

pkg/argocd/keycloak_defaults_test.go

@@ -1,6 +1,7 @@
 package argocd
 
 import (
+	"context"
 	"strings"
 	"testing"
 )
@@ -11,7 +12,7 @@ import (
 // produce a valid Keycloak state; regressions here are silent (the YAML
 // renders fine but Keycloak gets misconfigured), so we check structure.
 func TestRenderKeycloakDefaults(t *testing.T) {
-	rendered, err := RenderKeycloakDefaults(TemplateData{Domain: "test.example.com"})
+	rendered, err := RenderKeycloakDefaults(context.Background(), TemplateData{Domain: "test.example.com"})
 	if err != nil {
 		t.Fatalf("RenderKeycloakDefaults error: %v", err)
 	}
@@ -40,6 +41,21 @@ func TestRenderKeycloakDefaults(t *testing.T) {
 		"clientId: argocd",
 		"$(env:ARGOCD_CLIENT_SECRET)",
 		"https://argocd.test.example.com/auth/callback",
+		// Realm security posture — silent-but-damaging if a regression flips these.
+		"sslRequired: external",
+		"registrationAllowed: false",
+		"bruteForceProtected: true",
+		// Realm roles assigned to the bootstrap admin user.
+		"- name: admin",
+		"- name: user",
+		// Group-membership mapper emits a multivalued groups claim.
+		`multivalued: "true"`,
+		// argocd client security flags + CORS origin (webOrigins is distinct
+		// from redirectUris and Domain-templated, so assert it renders too).
+		"publicClient: false",
+		"standardFlowEnabled: true",
+		"directAccessGrantsEnabled: false",
+		"https://argocd.test.example.com\n",
 	} {
 		if !strings.Contains(output, want) {
 			t.Errorf("expected %q in rendered realm config, got:\n%s", want, output)
@@ -62,4 +78,10 @@ func TestRenderKeycloakDefaults(t *testing.T) {
 	if strings.Contains(output, "{{") || strings.Contains(output, "}}") {
 		t.Errorf("rendered output contains unresolved template markers, got:\n%s", output)
 	}
+
+	// missingkey=error should make a stray field error out, but guard against
+	// a rendered "<no value>" leaking into the realm config regardless.
+	if strings.Contains(output, "<no value>") {
+		t.Errorf("rendered output contains \"<no value>\" from an unresolved field, got:\n%s", output)
+	}
 }