L5 — Identity & integration
Single sign-on across every UI, plus the API gateway.
Keycloak / RHBK
| Item | Value |
|---|---|
| URL | https://sso.airgap.lab (hub, ns keycloak) |
| Realm | platform (2 replicas, PG-15 on LVMS) |
| Secrets | DB + client secrets from Vault apps/keycloak/* via ESO |
| LDAP | binds to FreeIPA (ipa-0/1) |
SSO coverage
One Keycloak login (zeadmin) works across all major UIs:
| UI | Auth |
|---|---|
| Both OpenShift consoles | OAuth IdP keycloak (zeadmin = cluster-admin; kubeadmin = break-glass) |
| ACM | via hub console |
| GitLab, Vault, Argo, ACS | OIDC client in realm platform |
Client secrets are kept out of git — KeycloakRealmImport pulls placeholders from secrets.
APISIX API gateway
| Item | Value |
|---|---|
| Public VIP | api.airgap.lab (TLS, lab CA in system trust) |
| Nodes | .43–.44/.46 (apisix); etcd apisix-etcd; gateways apisix-gw-0/1 |
| Routes | public /api/hello (rate-limited 5/min → 429); secure /api/secure (OIDC — 401 without token) |
| OIDC | Keycloak client apisix (client_credentials) for the secure route |
| Smoke test | rhel-app-vm:/root/gateway-smoke.sh |
GitOps vs. out-of-band
Keycloak/OIDC config is GitOps (hub/keycloak, hub/oidc, */oidc); client secrets flow from Vault via ESO. APISIX runs on VMs (not GitOps) — see Apps.