Add platform-viewer role

[shreddedbacon]

Checklist

• Affected Issues have been mentioned in the Closing issues section
• Documentation has been written/updated
• PR title is ready for changelog and subsystem label(s) applied

This adds a new role to keycloak called platform-viewer.
The role has only the ability to:

• view logs in elasticsearch
• view projects in lagoon and associated
  • environments
  • deployments
  • tasks
  • backups
  • facts
  • problems
• view notifications
• view groups
• view ssh keys

Closing issues

Put closes #XXXX in your comment to auto-close the issue that your PR fixes (if such).

[rocketeerbkw]

This script runs on every keycloak startup and needs to be idempotent. It also has to handle both use cases of installing a fresh keycloak (new cluster, CI, etc) and updating existing ones (e.g, prod). For those reasons, every function in here is designed to be run only once per keycloak install. And the order of functions is handled in the main configure_keycloak function.

The update mechanism is handled by first checking if some data exists that would've been created by the function and bailing if it is. It works kind of like drupal update_N functions but without the nice hook_install that can give you a nice fresh start DX. So your changes to configure_api_client won't get made to a production keycloak because of this check.

All your changes here need to get moved to a new function, check that it will only be run once, and called from configure_keycloak. Any changes that are additions, you can just copy/paste, but anytime you modify an existing resource, you'll have to figure out how to do an edit in place (like changing the policies on the View Task permission). You can check the other functions for examples for editing resources.

Also, this is not the first time this has come up, so maybe you can add a comment at the top of this file, or in configure_keycloak that explains it to save someone else (I also thought I did that, or suggested that already, but can't find any evidence so 🤷).

[shreddedbacon]

Ahh, did not know this about the startup script.
I'll adjust accordingly. Thanks!

[shreddedbacon]

Closing this one off, we can re-evaluate this later on if required.