From cbfb76fd4b9aa0dd12aed1e9a5a776eba7351da5 Mon Sep 17 00:00:00 2001
From: Mauricio Harley <mharley@redhat.com>
Date: Thu, 23 Jul 2026 15:57:28 +0000
Subject: [PATCH] [federation] Remove manual Keycloak Route creation

The "Create Route for Keycloak" task creates a passthrough TLS Route
that races with the RHSSO operator's own Route reconciliation. When
the operator wins the race, it overwrites the Route with reencrypt
and everything works. When Ansible wins, the Route stays as
passthrough and OIDC authentication fails with SSL verification
errors because the trust bundle only contains the ingress operator
CA, which does not sign the Keycloak pod's self-signed certificate.

The Keycloak CR already sets externalAccess.enabled=true, which
tells the RHSSO operator to create and manage the Route itself as
reencrypt with the correct destinationCACertificate. Removing the
manual Route creation eliminates the race condition entirely.

Signed-off-by: Mauricio Harley <mharley@redhat.com>
---
 roles/federation/tasks/run_keycloak_setup.yml | 24 -------------------
 1 file changed, 24 deletions(-)

diff --git a/roles/federation/tasks/run_keycloak_setup.yml b/roles/federation/tasks/run_keycloak_setup.yml
index f945c3617..74ab84d1a 100644
--- a/roles/federation/tasks/run_keycloak_setup.yml
+++ b/roles/federation/tasks/run_keycloak_setup.yml
@@ -146,30 +146,6 @@
   retries: 30
   delay: 10
 
-- name: Create Route for Keycloak
-  kubernetes.core.k8s:
-    kubeconfig: "{{ cifmw_openshift_kubeconfig }}"
-    state: present
-    definition:
-      apiVersion: route.openshift.io/v1
-      kind: Route
-      metadata:
-        name: keycloak
-        namespace: "{{ cifmw_federation_keycloak_namespace }}"
-      spec:
-        host: "keycloak-{{ cifmw_federation_keycloak_namespace }}.{{ cifmw_federation_domain }}"
-        to:
-          kind: Service
-          name: keycloak
-        port:
-          targetPort: 8443
-        tls:
-          termination: passthrough
-  register: _keycloak_route
-  until: _keycloak_route is succeeded
-  retries: 30
-  delay: 10
-
 - name: Grant privileged SCC to namespace default serviceaccount for Keycloak
   environment:
     KUBECONFIG: "{{ cifmw_openshift_kubeconfig }}"