feat: add organization tenancy to the oop realm, a localhost-only...

  clusters detect it at install). Every token carries `iss=<public URL>/realms/<realm>`, even when a pod

  fetches it from `http://keycloak:8080`. Services only know the in-cluster URL: they read the issuer

  from Keycloak's discovery document and fetch signing keys there, so no public URL is configured in them.

- Tokens from `oop-portal` carry `aud: oeg`.

- Tokens from `oop-portal` carry `aud: oeg` and, when the user has one, an `organization` claim.

- **Tenancy.** The user attribute `organization` is the tenant OEG scopes data by; a user without one

  is a tenant of their own (`sub`). Only administrators see or set it (lowercase letters, digits and

  hyphens, e.g. `acme-labs`). The registration form asks for an optional *Organization*, stored as

  `requested_organization`. It is never trusted, since anyone can type any name: a platform

  administrator reads it and sets `organization` (Users → the user → Details → *Organization ID*), and

  the user's next token carries it.

- There is no mail server, so nothing is sent by email (no verification, no reset links). "Forgot

  password?" stays on the login page, but its texts (`keycloak.realms.oop.forgotPassword`) tell users to

  ask a platform administrator. An admin resets the password in the admin console: Users → the user →

  with `keycloak.admin.password` / `keycloak.realms.oop.portal.clientSecret` in `secrets.values.yaml`.

- The kind environment also creates sample users, one per role: `dev-provider` (`app-provider`),

  `dev-operator` (`operator`) and `dev-admin` (`platform-admin`), sharing the password in

  `keycloak-credentials` → `dev-user-password`. They come from `keycloak.realms.oop.sampleUsers`, which

  refuses to render unless Keycloak's public URL is `http://localhost[:port]` or `http://127.0.0.1[:port]`.

  `keycloak-credentials` → `dev-user-password`, and all belong to organization `dev-org`. They come from

  `keycloak.realms.oop.sampleUsers`, which refuses to render unless Keycloak's public URL is

  `http://localhost[:port]` or `http://127.0.0.1[:port]`.

- **Realm import only creates missing realms.** After a realm exists, changes to its JSON are ignored:

  apply them in the admin console, or delete the realm (or the `keycloak` database) and restart Keycloak.

Seed users can log in to the account console at http://localhost:30081/realms/oop/account.

### Trying OOP without login

For a quick look on your own machine, turn login off for the whole platform:

```bash

helm upgrade --install oop-platform ./oop-platform-chart -n oop \

  -f environments/kind/values.yaml --set global.auth.enabled=false

```

Keycloak is not deployed, and neither is Federation Manager, since partner OPs must authenticate.

Rendering fails unless `global.publicHost` is `localhost` or `127.0.0.1`: without login, anyone who can

reach the portal or OEG can deploy workloads on the cluster.

---

## Deploy on kind (one command)

      tag: "1.1"

      pullPolicy: IfNotPresent

federationManager:

  federationManager:

    config:

      partner_op:

        host: "192.168.123.178"

        server: "/operatorplatform/federation/v1"

        port: "8992"

    service:

      type: NodePort

      nodePort: 30989

    image:

      repository: labs.etsi.org:5050/oop/code/federation-manager

      tag: "1.1"

      pullPolicy: IfNotPresent

    env:

      federationManagerHost: "http://federation-manager.oop.svc.cluster.local:8989/operatorplatform/federation/v1"

      tokenEndpoint: "http://keycloak.oop.svc.cluster.local:8080/realms/federation/protocol/openid-connect/token"

  mongodb:

    persistence:

      storageClass: manual

      hostPath:

        enabled: true

        path: /mnt/data/mongodb_fm

    image:

      pullPolicy: IfNotPresent

postgresql:

  persistence:

    storageClass: standard

    condition: oeg.enabled

  - name: federation-manager

    version: "1.0.0"

    condition: federationManager.enabled

    condition: federation-manager.enabled

  - name: ai2

    version: "1.0.0"

    condition: ai2.enabled

   dependencies:

     - name: federation-manager

       version: "1.0.0"

       condition: federationManager.enabled

       condition: federation-manager.enabled

   ```

3. Add to OOP platform `values.yaml`:

3. Add to OOP platform `values.yaml`. Everything, the on/off switch included, goes under the

   chart's name, `federation-manager`: Helm passes a subchart only the values under its own name.

   ```yaml

   federationManager:

   federation-manager:

     enabled: true

     federationManager:

       # ... federation manager configuration

   ```

app.kubernetes.io/instance: {{ .Release.Name }}

{{- end }}

{{/*

"true" unless global.auth.enabled is false. Federation needs authenticated partners, so with

login turned off for the platform Federation Manager and its MongoDB are not deployed.

Empty otherwise, so it works directly in an `if`.

*/}}

{{- define "federation-manager.authEnabled" -}}

{{- if dig "auth" "enabled" true (.Values.global | default dict) }}true{{ end -}}

{{- end }}

{{/*

Keycloak settings: this chart's own value when set, else the umbrella chart's `global` block,

else a built-in default, so the chart also installs on its own.