Add workflow to run conda-store user journey tests

[soapy1]

Reference Issues or PRs

fixes #2760

• Runs conda-store integration tests as part of test_local_integration
• Adds the option to specify a --group flag when adding a keycloak user

To create a keycloak user with access to a particular group, run the command

nebari keycloak adduser --user username password --config nebari-config.yaml --groups mygroup

What does this implement/fix?

Put a x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe): CI change

[soapy1]

depends on conda-incubator/conda-store#1040

[viniciusdc]

Since these tests depend on a live cluster, I suggest extending the already existing local integration tests with this extra check https://github.com/nebari-dev/nebari/blob/main/.github/workflows/test_local_integration.yaml -- since it uses CiRun under the hood you should not be affected by any flakiness of the GH runner in case of constrained resources.

[soapy1]

I'm not a fan of this approach to passing arguments around but did this to follow the pattern already defined in this part of the code.
I would be happy to refactor this module to make it a more developer friendly if that's something the nebari team is into.
Could also split that into a separate PR.

[dcmcand]

why don't you split that into a different pr. Thanks!

[soapy1]

Looks like this functionality is also implemented in #2917. Will rebase my changes when it get's merged.

[viniciusdc]

@soapy1 this requires the nebari keycloak command update to work, right? If that's the case, @Adam-D-Lewis do you mind splitting that ENH into another PR to decouple from the service-account one? We can also keep it in here as well

[Adam-D-Lewis]

@soapy1 this requires the nebari keycloak command update to work, right? If that's the case, @Adam-D-Lewis do you mind splitting that ENH into another PR to decouple from the service-account one? We can also keep it in here as well

Yeah, I can split that out into a separate PR today.

[Adam-D-Lewis]

Here's the keycloak cli refactor PR - #2968

[dcmcand]

@soapy1 please let me know when this is ready to go so we can get it merged

[marcelovilla]

This looks great @soapy1 !

In the spirit of achieving testing parity, I think it would be worthwhile to also run these tests on cloud deployments. That's beyond the scope of this PR but something to keep in mind when we start running other test suites in cloud deployments too.