Field report: deploying on a keycloakx (/auth) + microk8s environment — 7 friction points

[brandonrc]

Deployed 0.1.4 successfully on a microk8s + nebari-operator v0.1.0 playground (Keycloak = codecentric keycloakx behind an /auth relative path, custom singleuser image). Everything works — hub-managed OAuth via the operator-provisioned client, per-user spawns, jhub-apps — but these cost time and may bite others:

1. Path-prefixed Keycloak issuers unsupported: the keycloak.hostname derivation builds https://<host>/realms/... with no way to express keycloakx's standard /auth prefix; rbac.bootstrap.kcHost's default likewise omits it. Workaround: leave keycloak.hostname empty and rely on the operator Secret's issuer-url.
2. Home-PVC size knob mismatch: 01-spawner.py reads custom.storage-capacity for the home PVC but values.yaml only documents workspace-storage-capacity — home size is effectively an undocumented default.
3. nss-wrapper assumptions: LD_PRELOAD=libnss_wrapper.so is applied to every image (foreign images without it log ld.so errors on each exec) and _generate_nss_files hardcodes uid 1000 — custom images with other uids (ours: 999) don't match.
4. nebi coupling defaults-on: without nebari-nebi-pack the chart still derives a non-empty nebi-internal-url and pulls the nebi init container on every spawn; opting out requires discovering nebi.image.tag: "".
5. custom.profiles is replaced wholesale — adding one profile means copying the pack defaults verbatim (comment acknowledges it; still a trap).
6. Release-name-coupled Secret names are hardcoded in three places (extraVolumes, extraEnv, rbac job) — any release name other than the documented one silently falls back to dummy auth.
7. Startup ordering: the oauth Secret mounts optional: true but the config unconditionally reads /etc/oauth/issuer-url when a hostname is rendered — the hub crash-loops until the operator provisions the client (self-heals, but reads as a failure).

Happy to split any of these into their own issues / PRs.