refactor(deploy): externalize compose credentials and subsystem test secrets (FLPATH-4806)

Makefile

@@ -13,9 +13,12 @@ $(error No supported container engine found. Please install podman or docker, or
 endif
 
 COMPOSE_FILE := deploy/compose.yaml
+COMPOSE_ENV_FILE := deploy/.env
+COMPOSE_DEPLOY := $(COMPOSE) --env-file $(COMPOSE_ENV_FILE) -f $(COMPOSE_FILE)
 COMPOSE_PROJECT_NAME ?= control-plane
 COMPOSE_NETWORK := $(COMPOSE_PROJECT_NAME)_default
-PROFILES ?= providers
+PROFILES ?=
+AUTH ?=
 
 COMPOSE ?= $(shell command -v podman-compose >/dev/null 2>&1 && echo podman-compose || \
 	(command -v docker-compose >/dev/null 2>&1 && echo docker-compose || \
@@ -54,12 +57,14 @@ run-dev:
 	go run ./cmd/$(BINARY_NAME)
 
 # Platform stack: Postgres, NATS, control-plane, and dcm-ui (see deploy/compose.yaml).
+# Optional: AUTH=true to also start Keycloak (uncomment auth vars in deploy/.env first).
 compose-up:
-	$(COMPOSE) -f $(COMPOSE_FILE) up -d --build
+	$(COMPOSE_DEPLOY) $(if $(filter true,$(AUTH)),--profile auth,) up -d --build
 
 # Platform stack with optional service providers (see deploy/RUN.md).
+# Optional: AUTH=true to also start Keycloak.
 compose-up-with-providers:
-	$(COMPOSE) -f $(COMPOSE_FILE) --profile $(PROFILES) up -d --build
+	$(COMPOSE_DEPLOY) $(if $(filter true,$(AUTH)),--profile auth,) --profile $(or $(PROFILES),providers) up -d --build
 
 # Tear down the compose stack. Kind (or other externals) joined to the compose
 # network block "compose down" from removing it — disconnect them first.
@@ -80,8 +85,8 @@ compose-down:
 			fi; \
 		fi; \
 	done; \
-	COMPOSE_PROJECT_NAME=deploy $(COMPOSE) -f $(COMPOSE_FILE) down -v --remove-orphans 2>/dev/null || true; \
-	$(COMPOSE) -f $(COMPOSE_FILE) down -v --remove-orphans; \
+	COMPOSE_PROJECT_NAME=deploy $(COMPOSE_DEPLOY) down -v --remove-orphans 2>/dev/null || true; \
+	$(COMPOSE_DEPLOY) down -v --remove-orphans; \
 	for network in deploy_default $(COMPOSE_NETWORK); do \
 		if [ "$(CONTAINER_ENGINE)" = podman ]; then \
 			podman network rm -f "$$network" 2>/dev/null || true; \
@@ -107,6 +112,12 @@ GOLANGCI_LINT_VERSION ?= v2.12.2
 GINKGO := go run github.com/onsi/ginkgo/v2/ginkgo
 GINKGO_FLAGS := -r --randomize-all --fail-on-pending
 
+# Subsystem compose stacks read credentials from gitignored test/subsystem/.env.
+subsystem-env:
+	@test -f test/subsystem/.env || cp test/subsystem/.env.example test/subsystem/.env
+
+auth-subsystem-test-up catalog-subsystem-test-up policy-subsystem-test-up sp-subsystem-test-up: subsystem-env
+
 lint:
 	go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@$(GOLANGCI_LINT_VERSION) run ./...
 
@@ -117,5 +128,5 @@ tidy:
 	go mod tidy
 
 .PHONY: build build-gitops run run-dev compose-up compose-up-with-providers compose-down image-build \
-	clean fmt vet lint test test-catalog test-placement test-policy test-sp test-gitops tidy \
+	clean fmt vet lint test test-catalog test-placement test-policy test-sp test-gitops tidy subsystem-env \
 	helm-chart-sync helm-chart-verify-sync helm-chart-verify-admin-subject helm-chart-verify helm-chart-verify-schema helm-chart-lint helm-chart-template helm-chart-check

README.md

@@ -36,17 +36,20 @@ Run the monolith (pick one):
 |---------|---------------|----------|------------|
 | `make run` | host | SQLite at `/tmp/control-plane.db` | NATS disabled |
 | `make run-dev` | host | Postgres (`DB_*` defaults) | Postgres + NATS running locally |
-| `make compose-up` | containers | Postgres in compose | also starts NATS, Keycloak, control-plane, and dcm-ui |
+| `make compose-up` | containers | Postgres in compose | also starts NATS, control-plane, and dcm-ui (no Keycloak) |
 
 ```bash
 make run              # SQLite, no containers
+cp deploy/.env.example deploy/.env
 make compose-up       # platform stack in containers
+make compose-up AUTH=true  # same + Keycloak when auth is enabled in .env
 make compose-down     # stop stack and remove volumes
 ```
 
-Compose uses `POSTGRES_USER` and `POSTGRES_PASSWORD` (defaults in compose
-are for local dev only). Override via environment or a `.env` file; see
-`deploy/.env.example`.
+Compose credentials live in `deploy/.env` (copy from `deploy/.env.example`). Keycloak
+uses the `auth` compose profile — `make compose-up AUTH=true` after uncommenting the auth block
+in `.env`. With providers: `make compose-up-with-providers PROFILES=kubevirt AUTH=true`.
+Subsystem tests use the shared `test/subsystem/.env.example` file.
 
 Policy evaluation and placement provisioning run in-process in the monolith
 (`EvaluationService`, `PlacementService` via local clients). There is no public

deploy/.env.example

@@ -1,57 +1,59 @@
-# Optional: copy to .env in the repo root and set for local overrides.
-# Used by deploy/compose.yaml. Defaults (admin / adminpass) are for local dev only.
-# POSTGRES_USER=admin
-# POSTGRES_PASSWORD=adminpass
-
-# --- Authentication ---
-# Auth is disabled by default. Set AUTH_DISABLED=false to enable.
-# DCM_ADMIN_SUBJECT is required when auth is enabled (must match a Keycloak user id).
-# AUTH_DISABLED=true
+# Copy to deploy/.env before starting the stack (see deploy/RUN.md).
+# Lab defaults below — keep in sync with kubectl Secret blocks in RUN.md / deploy/helm/dcm/README.md.
+
+# === Required (default stack: postgres, nats, control-plane, dcm-ui) ===
+POSTGRES_USER=admin
+POSTGRES_PASSWORD=adminpass
+DB_USER=admin
+DB_PASS=adminpass
+DB_PASSWORD=adminpass
+
+# === Enable authentication (make compose-up AUTH=true) ===
+# KEYCLOAK_ADMIN=admin
+# KEYCLOAK_ADMIN_PASSWORD=admin
+# DCM_DEV_USER_PASSWORD=admin
+# AUTH_PROXY_SECRET=dcm-dev-proxy-secret
+# AUTH_DISABLED=false
 # AUTH_ISSUER_URL=http://keycloak:8080/realms/dcm
 # AUTH_JWT_AUDIENCE=dcm-api
-# AUTH_PROXY_SECRET=dcm-dev-proxy-secret
-# AUTH_CACHE_TTL=60s
 # DCM_ADMIN_SUBJECT=56deb662-4820-5d83-b828-f4beb11a5fa7
-# KEYCLOAK_ADMIN_PASSWORD=admin
-# DCM_DEV_USER_PASSWORD=admin
+
+# === Optional knobs (image versions, SP profiles, ...) ===
+# CONTROL_PLANE_VERSION=main
+# KUBEVIRT_SERVICE_PROVIDER_VERSION=main
+# K8S_CONTAINER_SERVICE_PROVIDER_VERSION=main
+# K8S_STORAGE_SERVICE_PROVIDER_VERSION=main
+# ACM_CLUSTER_SERVICE_PROVIDER_VERSION=main
+# THREE_TIER_DEMO_SERVICE_PROVIDER_VERSION=main
+# DCM_UI_VERSION=main
+
+# ACM cluster service provider (profile: acm-cluster)
+# ACM_CLUSTER_SP_PULL_SECRET=<base64-encoded-dockerconfigjson>
+# ACM_CLUSTER_SP_NAME=acm-cluster-sp
+# ACM_CLUSTER_SP_BASE_DOMAIN=apps.example.com
+# ACM_CLUSTER_SP_NAMESPACE=default
+# ACM_CLUSTER_SP_KUBECONFIG=~/.kube/config
+# ACM_CLUSTER_SP_DEFAULT_INFRA_ENV=
+# ACM_CLUSTER_SP_AGENT_NAMESPACE=
+# See compose.override.example.yaml for OpenShift route exposure on three-tier SP
 
 # K8s container service provider (profile: k8s-container)
-# K8S_CONTAINER_SP_KUBECONFIG=/path/to/kubeconfig
 # K8S_CONTAINER_SP_NAMESPACE=default
+# K8S_CONTAINER_SP_KUBECONFIG=~/.kube/config
 # K8S_CONTAINER_SP_NAME=k8s-container-provider
 # K8S_CONTAINER_SP_EXTERNAL_SVC_TYPE=NodePort
 
 # K8s storage service provider (profile: storage)
-# K8S_STORAGE_SP_KUBECONFIG=/path/to/kubeconfig
 # K8S_STORAGE_SP_NAMESPACE=default
+# K8S_STORAGE_SP_KUBECONFIG=~/.kube/config
 # K8S_STORAGE_SP_NAME=k8s-storage-provider
 # K8S_STORAGE_SP_DEFAULT_STORAGE_CLASS=
 # K8S_STORAGE_SP_DEFAULT_ACCESS_MODE=ReadWriteOnce
 
 # Three-tier demo app service provider (profile: three-tier)
-# Same kubeconfig + cluster namespace as k8s-container (K8S_CONTAINER_SP_* above).
 # THREE_TIER_SP_NAME=three-tier-provider
 
-# ACM cluster service provider (profile: acm-cluster)
-# Supports two platforms: KubeVirt (default) and BareMetal.
-# Both enabled by default (SP_ENABLED_PLATFORMS=kubevirt,baremetal).
-# ACM_CLUSTER_SP_NAME=acm-cluster-sp
-# ACM_CLUSTER_SP_BASE_DOMAIN=apps.example.com
-# ACM_CLUSTER_SP_PULL_SECRET=<base64-encoded-dockerconfigjson>
-# BareMetal platform only — not used by KubeVirt:
-# ACM_CLUSTER_SP_DEFAULT_INFRA_ENV=my-infra-env
-# ACM_CLUSTER_SP_AGENT_NAMESPACE=my-agent-namespace
-
-# --- Service image versions ---
-# Pin specific versions instead of "main". Valid values:
-#   main               - most recent main build (default)
-#   v0.0.1             - final release (from git tag)
-#   v0.0.1-rc.3        - release candidate (from release branch)
-#   abc1234            - specific commit build (for local testing only)
-# CONTROL_PLANE_VERSION=main
-# KUBEVIRT_SERVICE_PROVIDER_VERSION=main
-# K8S_CONTAINER_SERVICE_PROVIDER_VERSION=main
-# K8S_STORAGE_SERVICE_PROVIDER_VERSION=main
-# ACM_CLUSTER_SERVICE_PROVIDER_VERSION=main
-# THREE_TIER_DEMO_SERVICE_PROVIDER_VERSION=main
-# DCM_UI_VERSION=main
+# KubeVirt service provider (profile: kubevirt)
+# KUBEVIRT_KUBECONFIG=~/.kube/config
+# KUBEVIRT_PROVIDER_NAME=kubevirt-service-provider
+# KUBERNETES_NAMESPACE=default