Aligns the render-side e2e bats with the users-map contract:
- Feed a `spec.oidc.users:` entry to each mode's Monitoring CR so
the reconcile Job has real input to act on.
- Assert the users-Job appears in the release namespace with the
desired `DESIRED_USERS_JSON` env and the expected `OIDC_MODE`.
- Assert the Grafana CR renders with `skip_org_role_sync = "true"`
and `oauth_allow_insecure_email_lookup = "true"` and NO
`role_attribute_path`.
- Flip the three KeycloakRealmGroup existence assertions to
negative checks: chart-owned realm groups must NOT be present
in either System or CustomConfig mode.
Does not add a full OIDC login flow through Keycloak — that stays
deferred to a follow-up integration suite, same posture as the
tenant kube-apiserver's kubernetes-oidc-system.bats.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
IvanHunters
123616a1d0