[ENH] - Make Nebari admin group also have keycloak realm admin permissions

[costrouc]

Feature description

Currently users have to login with the root keycloak credentials to manage users/groups etc. It would be nice to make the admins of a particular realm in the "admin" group also have permissions to edit keycloak without requiring the root username and password.

Related docs https://github.com/keycloak/keycloak-documentation/blob/main/server_admin/topics/admin-console-permissions/master-realm.adoc#master-realm-access-control

Value and/or benefit

Security and easy ability to add users to self manage the cluster.

Anything else?

No response

[costrouc]

Currently admin root/pasword credentials are needed in order to modify users/groups and this should not be required. Instead the roles to perform this should be attached to the group admin. Below are the following roles that need to be added to the admin keycloak group.

We need to add the realm-admin role within realm-management in the nebari realm to the admin group as show above. Once this is done any user can visit https://nebari.quansight.dev/auth/admin/nebari/console and edit users/groups etc. You will see that we can give more fine grained permissions e.g. only edit users/groups but for now realm-admin will give everything ensuring that we don't have to give out the root, ... to everyone.

[costrouc]

This will involve editing:

• https://github.com/nebari-dev/nebari/blob/main/nebari/template/stages/06-kubernetes-keycloak-configuration/main.tf
• https://registry.terraform.io/providers/mrparkers/keycloak/latest/docs/resources/group_roles adding the role from the client to the application

[costrouc]

Adding to this issue since it would fit in well.

• We need two groups for admin: admin and superadmin
• admin will only do administrative tasks and should protect them from actions that can destroy the cluster so they should have the roles view-* actions, manage-users, impersonation, , create-client` anything that cannot break things on nebari
• superadmin will have the realm-admin role which can do anything including things that can break the cluster.