Fix reconcile crash when Keycloak detection tasks are skipped

[fabianvf]

Problem

The llm-proxy-test CI on konveyor#562 fails during reconcile (run 26526639422). The Tackle CR never becomes ready, and no hub/ui/kai-db/llm-proxy workloads are created — the playbook aborts early:

TASK [Set federated IDP issuer based on detection or explicit config]
fatal: [localhost]: FAILED! => "'dict object' has no attribute 'resources'"
.../roles/tackle/tasks/main.yml:575

Root cause

The Set federated IDP issuer set_fact guards the conditionally-registered rhsso_keycloak_cr / rhbk_keycloak_cr vars with is defined. Those two k8s_info tasks only run when: app_profile == 'mta'. On other profiles (CI runs the konveyor profile) they are skipped — but a skipped task still registers a result dict, one that has no .resources key.

So rhsso_keycloak_cr is defined is True (it's the skip-result dict), the template proceeds to evaluate .resources, and Jinja raises 'dict object' has no attribute 'resources'. The earlier branches are all false in CI (keycloak_sso_url/rhbk_url empty, no standalone Keycloak service), so execution always reaches the broken elif.

Fix

Keep the is defined guard — it short-circuits a genuinely undefined var (and and short-circuits in Jinja, so .resources is never evaluated in that case) — and add default([]) on the attribute so the skipped-register case (defined dict, missing .resources) collapses to an empty list:

{% elif rhsso_keycloak_cr is defined and rhsso_keycloak_cr.resources | default([]) | length > 0 %}
{% elif rhbk_keycloak_cr is defined and rhbk_keycloak_cr.resources | default([]) | length > 0 %}

(default([]) alone is not enough: it only rescues the missing-attribute case. If the base var were ever fully undefined, evaluating .resources on it would raise before the filter runs — hence keeping is defined.)

standalone_keycloak_svc needs no change — that task always runs, so it always has .resources.

Test plan

• llm-proxy-test (and the other install jobs) on ✨ Keycloak dependency removed. konveyor/operator#562 get past the reconcile and create all workloads