:bug: Fix llm-proxy JWT issuer mismatch on MTA profile by fabianvf · Pull Request #552 · konveyor/operator

fabianvf · 2026-03-09T14:17:50Z

The llm-proxy configmap template always used keycloak_sso_url for the JWKS URI and issuer, which resolves to mta-keycloak-rhbk on the MTA profile. However, the actual RHBK service is mta-rhbk-service, and the hub already correctly uses rhbk_url for MTA. This caused the llm-proxy to reject all JWT tokens with "Invalid JWT token" because the issuer in the token didn't match what the proxy expected.

Add the same app_profile == 'mta' conditional used by the hub and UI templates so the llm-proxy uses rhbk_url on MTA and keycloak_sso_url on konveyor.

Summary by CodeRabbit

Chores
- Improved OAuth2/OpenID Connect configuration: the system now correctly interprets the authentication-required flag and selects the appropriate JWKS URI and issuer depending on the deployment profile (including a new branch for the "mta" profile). This improves authentication behavior across different environments.

The llm-proxy configmap template always used keycloak_sso_url for the JWKS URI and issuer, which resolves to mta-keycloak-rhbk on the MTA profile. However, the actual RHBK service is mta-rhbk-service, and the hub already correctly uses rhbk_url for MTA. This caused the llm-proxy to reject all JWT tokens with "Invalid JWT token" because the issuer in the token didn't match what the proxy expected. Add the same app_profile == 'mta' conditional used by the hub and UI templates so the llm-proxy uses rhbk_url on MTA and keycloak_sso_url on konveyor. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us>

coderabbitai · 2026-03-09T14:18:08Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 59d5e4c5-520d-463d-81fd-bd588ab8e68c

📥 Commits

Reviewing files that changed from the base of the PR and between 9c74171 and 7ba87d9.

📒 Files selected for processing (1)

roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2

📝 Walkthrough

Walkthrough

A Jinja config template was modified to cast feature_auth_required to boolean and to branch JWKS URI and issuer selection by app_profile: when app_profile == 'mta' it uses rhbk_url/RHBK realm paths, otherwise it uses the existing keycloak_sso_url-based paths. Audience and other auth fields unchanged.

Changes

Cohort / File(s)	Summary
JWKS & auth flag update `roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2`	Replaced strict Jinja condition with `feature_auth_required

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

I'm a rabbit in code, with hops full of glee,
A bool and a branch make the config run free.
When mta comes along, RHBK takes the stage,
Keycloak stays ready for the more common page.
A tiny change sings—quiet, clever, and spry. 🐇✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: fixing a JWT issuer mismatch specific to the MTA profile in the llm-proxy configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2`:
- Around line 115-123: The rhbk_url default is constructed using the wrong
protocol/port vars (it uses rhsso_proto and rhsso_port) which causes incorrect
URLs when rhbk_tls_enabled differs; update the rhbk_url definition in defaults
to use rhbk_proto and rhbk_port (or compute rhbk_proto/rhbk_port from
rhbk_tls_enabled the same way rhsso_* are computed) so rhbk_url consistently
reflects rhbk_tls_enabled and the intended rhbk_* values referenced by templates
like llm-proxy-configmap.yaml.j2 and deployment-hub.yml.j2.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: db5253a2-0f74-4c9c-bdbb-51161332f2a5

📥 Commits

Reviewing files that changed from the base of the PR and between 50df9e0 and 9c74171.

📒 Files selected for processing (1)

roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2

coderabbitai · 2026-03-09T14:21:21Z

+{% if app_profile == 'mta' %}
+            uri: "{{ rhbk_url }}/auth/realms/{{ keycloak_sso_realm }}/protocol/openid-connect/certs"
+          # The issuer must match exactly what's in the JWT token from hub auth
+          issuer: "{{ rhbk_url }}/auth/realms/{{ keycloak_sso_realm }}"
+{% else %}
            uri: "{{ keycloak_sso_url }}/auth/realms/{{ keycloak_sso_realm }}/protocol/openid-connect/certs"
          # The issuer must match exactly what's in the JWT token from hub auth
          issuer: "{{ keycloak_sso_url }}/auth/realms/{{ keycloak_sso_realm }}"
+{% endif %}


⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash # Verify rhbk_url construction and check if rhsso/rhbk TLS settings could diverge echo "=== Checking rhbk_url definition ===" rg -n 'rhbk_url:' roles/tackle/defaults/ echo "" echo "=== Checking rhsso_tls_enabled vs rhbk_tls_enabled definitions ===" rg -n '(rhsso_tls_enabled|rhbk_tls_enabled):' roles/tackle/defaults/ echo "" echo "=== Checking all usages of rhbk_url to see if this is a known pattern ===" rg -n 'rhbk_url' --type jinja2 2>/dev/null || rg -n 'rhbk_url' -g '*.j2'

Repository: konveyor/operator

Length of output: 1006

Conditional pattern is consistent with hub deployment.

The app_profile == 'mta' conditional mirrors the pattern in deployment-hub.yml.j2 for KEYCLOAK_HOST, ensuring the LLM proxy uses the same Keycloak endpoint as the hub.

However, note a pre-existing bug in roles/tackle/defaults/main.yml (line 276) affecting rhbk_url construction:

rhbk_url: "{{ rhsso_proto }}://{{ rhbk_service_name }}-service.{{ app_namespace }}.svc:{{ rhsso_port }}"

The rhbk_url uses rhsso_proto and rhsso_port instead of rhbk_proto and rhbk_port. Since rhsso_tls_enabled is always true but rhbk_tls_enabled is conditional on OpenShift clusters, rhbk_url will have incorrect protocol/port values on non-OpenShift clusters. This affects deployments of the UI, hub, and kai/llm-proxy.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2` around lines 115 - 123, The rhbk_url default is constructed using the wrong protocol/port vars (it uses rhsso_proto and rhsso_port) which causes incorrect URLs when rhbk_tls_enabled differs; update the rhbk_url definition in defaults to use rhbk_proto and rhbk_port (or compute rhbk_proto/rhbk_port from rhbk_tls_enabled the same way rhsso_* are computed) so rhbk_url consistently reflects rhbk_tls_enabled and the intended rhbk_* values referenced by templates like llm-proxy-configmap.yaml.j2 and deployment-hub.yml.j2.

djzager

Doing this will prevent this section from showing up in the llm-proxy configuration when auth is disabled.

Co-authored-by: David Zager <dzager@redhat.com> Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us>

The llm-proxy configmap template always used keycloak_sso_url for the JWKS URI and issuer, which resolves to mta-keycloak-rhbk on the MTA profile. However, the actual RHBK service is mta-rhbk-service, and the hub already correctly uses rhbk_url for MTA. This caused the llm-proxy to reject all JWT tokens with "Invalid JWT token" because the issuer in the token didn't match what the proxy expected. Add the same app_profile == 'mta' conditional used by the hub and UI templates so the llm-proxy uses rhbk_url on MTA and keycloak_sso_url on konveyor.  ## Summary by CodeRabbit * **Chores** * Improved OAuth2/OpenID Connect configuration: the system now correctly interprets the authentication-required flag and selects the appropriate JWKS URI and issuer depending on the deployment profile (including a new branch for the "mta" profile). This improves authentication behavior across different environments.  --------- Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: David Zager <dzager@redhat.com> Signed-off-by: Cherry Picker <noreply@github.com>

konveyor-ci-bot · 2026-03-10T19:49:32Z

PR cherry-picked to branch release-0.9. Backport PR: #554

The llm-proxy configmap template always used keycloak_sso_url for the JWKS URI and issuer, which resolves to mta-keycloak-rhbk on the MTA profile. However, the actual RHBK service is mta-rhbk-service, and the hub already correctly uses rhbk_url for MTA. This caused the llm-proxy to reject all JWT tokens with "Invalid JWT token" because the issuer in the token didn't match what the proxy expected. Add the same app_profile == 'mta' conditional used by the hub and UI templates so the llm-proxy uses rhbk_url on MTA and keycloak_sso_url on konveyor.  ## Summary by CodeRabbit * **Chores** * Improved OAuth2/OpenID Connect configuration: the system now correctly interprets the authentication-required flag and selects the appropriate JWKS URI and issuer depending on the deployment profile (including a new branch for the "mta" profile). This improves authentication behavior across different environments.  --------- Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: David Zager <dzager@redhat.com> Signed-off-by: Cherry Picker <noreply@github.com> Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us> Signed-off-by: Cherry Picker <noreply@github.com> Co-authored-by: Fabian von Feilitzsch <fabian@fabianism.us> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: David Zager <dzager@redhat.com>

coderabbitai Bot reviewed Mar 9, 2026

View reviewed changes

dymurray added the cherry-pick/release-0.9 This PR should be cherry-picked to release-0.9 branch label Mar 9, 2026

djzager requested changes Mar 9, 2026

View reviewed changes

Comment thread roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2 Outdated

Update roles/tackle/templates/kai/llm-proxy-configmap.yaml.j2

7ba87d9

Co-authored-by: David Zager <dzager@redhat.com> Signed-off-by: Fabian von Feilitzsch <fabian@fabianism.us>

djzager approved these changes Mar 10, 2026

View reviewed changes

dymurray merged commit bb2a89d into konveyor:main Mar 10, 2026
14 checks passed

abrugaro mentioned this pull request May 6, 2026

LLM Proxy is not working konveyor/kai#923

Closed

This was referenced Jun 5, 2026

operator konveyor-operator (0.10.0-alpha.1) k8s-operatorhub/community-operators#8301

Merged

operator konveyor-operator (0.10.0-alpha.1) redhat-openshift-ecosystem/community-operators-prod#9937

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Fix llm-proxy JWT issuer mismatch on MTA profile#552

🐛 Fix llm-proxy JWT issuer mismatch on MTA profile#552
dymurray merged 2 commits into
konveyor:mainfrom
fabianvf:support-rhbk

fabianvf commented Mar 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Mar 9, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Mar 9, 2026

Uh oh!

djzager left a comment

Uh oh!

Uh oh!

Uh oh!

konveyor-ci-bot Bot commented Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

fabianvf commented Mar 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

djzager left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

konveyor-ci-bot Bot commented Mar 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fabianvf commented Mar 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Mar 9, 2026 •

edited

Loading