setting up readonly user in schema registry - not working

[karanalang]

i've installed apicurio schema registry operator & schema registry in namespace - apicurio-registry-operator
I've keycloak installed in na - keycloak.

I'm trying to setup readonly user (i.e. user should not be able to publish schema but should be able to read schema), and facing issues.

here is the configuration done :

On keycloak -
created

1. new realm -> readonly-realm
2. created client - apicurio with Standard flow & Direct access grants enabled
3. created realm-roles - sr-admin, sr-developer, sr-readonly
4. created user - ro-user and assigned the role - sr-readonly to the user.

I'm able to get the token for the ro-user using the command

curl -X POST http://<keycloakurl:port>/realms/readonly-realm/protocol/openid-connect/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=apicurio" \
  -d "username=ro-user" \
  -d "password=ro-user" \
  -d "grant_type=password"

Schema Registry is installed using the following yaml

apiVersion: registry.apicur.io/v1
kind: ApicurioRegistry
metadata:
  name: apicurio-registry
  namespace: apicurio-registry-operator
spec:
  configuration:
    # your existing SQL persistence
    persistence: sql
    sql:
      dataSource:
        url: jdbc:postgresql://my-postgres-postgresql.apicurio-registry-operator.svc.cluster.local:5432/postgres
        userName: postgres
        password:<pwd>

    env:
      # ────────────────────────────────────────────────────────────────────
      # 1) Enable OIDC auth via Keycloak
      # ────────────────────────────────────────────────────────────────────
      - name: AUTH_ENABLED
        value: "true"
      - name: KEYCLOAK_URL
        value: "http://keycloak-headless.keycloak.svc.cluster.local:8080"
      - name: KEYCLOAK_REALM
        value: "readonly-realm"
      - name: KEYCLOAK_API_CLIENT_ID
        value: "apicurio"
      - name: KEYCLOAK_UI_CLIENT_ID
        value: "apicurio"

      # ────────────────────────────────────────────────────────────────────
      # 2) Enable role‑based authorization
      # ────────────────────────────────────────────────────────────────────
      - name: ROLE_BASED_AUTHZ_ENABLED
        value: "true"
      - name: ROLE_BASED_AUTHZ_SOURCE
        value: "token"
      - name: REGISTRY_AUTH_ROLES_ADMIN
        value: "sr-admin"
      - name: REGISTRY_AUTH_ROLES_DEVELOPER
        value: "sr-developer"
      - name: REGISTRY_AUTH_ROLES_READONLY
        value: "sr-readonly"

      # ────────────────────────────────────────────────────────────────────
      # 3) Explicitly point the UI at the correct API & UI paths
      # ────────────────────────────────────────────────────────────────────
      - name: REGISTRY_API_URL
        value: "http://apicurio-registry.apicurio-registry-operator.svc.cluster.local:8081/apis/registry/v2"
      - name: REGISTRY_UI_CONFIG_APIURL
        value: "http://apicurio-registry.apicurio-registry-operator.svc.cluster.local:8081/apis/registry/v2"
      - name: REGISTRY_UI_CONFIG_UIURL
        value: "http://apicurio-registry.apicurio-registry-operator.svc.cluster.local:8081/ui"

Without the environment variables, the Schema Registry UI is coming up (afterport-forwarding) .. but after the env variables are added, the UI is not comig up .. also the schemas i'd pushed in are not being retrieved.

Any ideas on how to debug/fix this ?

tia!