add jhub apps service account with admin permissions

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/services/jupyterhub/main.tf

@@ -23,6 +23,7 @@ locals {
   userscheduler_nodeselector_value = var.general-node-group.value
 }
 
+
 resource "kubernetes_secret" "jhub_apps_secrets" {
   metadata {
     name      = local.jhub_apps_secrets_name
@@ -36,6 +37,26 @@ resource "kubernetes_secret" "jhub_apps_secrets" {
   type = "Opaque"
 }
 
+resource "keycloak_user" "jhub_apps_service_account" {
+  realm_id = var.realm_id
+  username = "jhub-apps-sa"
+  # email    = "jhub-apps-sa@${var.external-url}"
+  enabled = true # not sure if they need to be enabled,  TODO: check
+}
+
+data "keycloak_group" "admin_group" {
+  realm_id = var.realm_id
+  name     = "admin"
+}
+
+
+resource "keycloak_user_groups" "jhub_apps_service_account_groups" {
+  realm_id   = var.realm_id
+  user_id    = keycloak_user.jhub_apps_service_account.id
+  group_ids  = [data.keycloak_group.admin_group.id]
+  exhaustive = true # remove all other groups
+}
+
 locals {
   jupyterhub_env_vars = [
     {

src/_nebari/stages/kubernetes_services/template/modules/kubernetes/services/jupyterhub/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    keycloak = {
+      source  = "mrparkers/keycloak"
+      version = "3.7.0"
+    }
+  }
+  required_version = ">= 1.0"
+}