Skip to content

Commit 0747acc

Browse files
klinch0klinch0
committed
add keycloak
1 parent bfbde07 commit 0747acc

File tree

18 files changed

+438
-16
lines changed

18 files changed

+438
-16
lines changed

‎.pre-commit-config.yaml

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,4 @@
11
repos:
2-
- repo: https://github.com/pre-commit/pre-commit-hooks
3-
rev: v4.5.0
4-
hooks:
5-
- id: end-of-file-fixer
6-
- id: trailing-whitespace
7-
- id: mixed-line-ending
8-
args: [--fix=lf]
9-
- id: check-yaml
10-
exclude: '^.*templates/.*\.yaml$'
11-
args: [--unsafe]
12-
- repo: https://github.com/igorshubovych/markdownlint-cli
13-
rev: v0.42.0
14-
hooks:
15-
- id: markdownlint
16-
args: [--fix, --disable, MD013, MD041, --]
172
- repo: local
183
hooks:
194
- id: gen-versions-map

‎packages/apps/tenant/templates/tenant.yaml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,3 +88,57 @@ roleRef:
8888
kind: Role
8989
name: {{ include "tenant.name" . }}
9090
apiGroup: rbac.authorization.k8s.io
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1
93+
kind: Role
94+
metadata:
95+
name: cozy:{{ include "tenant.name" . }}-rw
96+
namespace: cozy-public
97+
rules:
98+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
99+
resources: ["*"]
100+
verbs: ["*"]
101+
- apiGroups: ["source.toolkit.fluxcd.io"]
102+
resources: ["helm.toolkit.fluxcd.io/v2"]
103+
verbs: ["*"]
104+
---
105+
apiVersion: rbac.authorization.k8s.io/v1
106+
kind: RoleBinding
107+
metadata:
108+
name: cozy:{{ include "tenant.name" . }}-rw
109+
namespace: cozy-public
110+
subjects:
111+
- kind: Group
112+
name: cozy:{{ include "tenant.name" . }}-rw
113+
apiGroup: rbac.authorization.k8s.io
114+
roleRef:
115+
kind: Role
116+
name: cozy:{{ include "tenant.name" . }}-rw
117+
apiGroup: rbac.authorization.k8s.io
118+
---
119+
apiVersion: rbac.authorization.k8s.io/v1
120+
kind: Role
121+
metadata:
122+
name: cozy:{{ include "tenant.name" . }}-ro
123+
namespace: cozy-public
124+
rules:
125+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
126+
resources: ["*"]
127+
verbs: ["get", "list", "watch"]
128+
- apiGroups: ["source.toolkit.fluxcd.io"]
129+
resources: ["helm.toolkit.fluxcd.io/v2"]
130+
verbs: ["get", "list", "watch"]
131+
---
132+
apiVersion: rbac.authorization.k8s.io/v1
133+
kind: RoleBinding
134+
metadata:
135+
name: cozy:{{ include "tenant.name" . }}-ro
136+
namespace: cozy-public
137+
subjects:
138+
- kind: Group
139+
name: cozy:{{ include "tenant.name" . }}-ro
140+
apiGroup: rbac.authorization.k8s.io
141+
roleRef:
142+
kind: Role
143+
name: cozy:{{ include "tenant.name" . }}-ro
144+
apiGroup: rbac.authorization.k8s.io

‎packages/core/platform/bundles/distro-full.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,3 +174,15 @@ releases:
174174
namespace: cozy-external-secrets-operator
175175
optional: true
176176
dependsOn: [cilium]
177+
178+
- name: postgres-instance
179+
releaseName: postgres-instance
180+
chart: cozy-postgres-instance
181+
namespace: cozy-keycloak
182+
dependsOn: [postgres-operator]
183+
184+
- name: keycloak
185+
releaseName: keycloak
186+
chart: cozy-keycloak
187+
namespace: cozy-keycloak
188+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/distro-hosted.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,15 @@ releases:
124124
namespace: cozy-external-secrets-operator
125125
optional: true
126126
dependsOn: []
127+
128+
- name: postgres-instance
129+
releaseName: postgres-instance
130+
chart: cozy-postgres-instance
131+
namespace: cozy-keycloak
132+
dependsOn: [postgres-operator]
133+
134+
- name: keycloak
135+
releaseName: keycloak
136+
chart: cozy-keycloak
137+
namespace: cozy-keycloak
138+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/paas-full.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,15 @@ releases:
249249
namespace: cozy-external-secrets-operator
250250
optional: true
251251
dependsOn: [cilium,kubeovn]
252+
253+
- name: postgres-instance
254+
releaseName: postgres-instance
255+
chart: cozy-postgres-instance
256+
namespace: cozy-keycloak
257+
dependsOn: [postgres-operator]
258+
259+
- name: keycloak
260+
releaseName: keycloak
261+
chart: cozy-keycloak
262+
namespace: cozy-keycloak
263+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/paas-hosted.yaml

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ releases:
1919
chart: cozy-cert-manager-crds
2020
namespace: cozy-cert-manager
2121
dependsOn: []
22-
22+
2323
- name: cozystack-api
2424
releaseName: cozystack-api
2525
chart: cozy-cozystack-api
@@ -145,3 +145,15 @@ releases:
145145
{{- end }}
146146
{{- end }}
147147
{{- end }}
148+
149+
- name: postgres-instance
150+
releaseName: postgres-instance
151+
chart: cozy-postgres-instance
152+
namespace: cozy-keycloak
153+
dependsOn: [postgres-operator]
154+
155+
- name: keycloak
156+
releaseName: keycloak
157+
chart: cozy-keycloak
158+
namespace: cozy-keycloak
159+
dependsOn: [postgres-instance]

‎packages/system/keycloak/Chart.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-keycloak
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

‎packages/system/keycloak/templates/ingress.yaml

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: keycloak-ingress
5+
{{- with .Values.ingress.Annotations }}
6+
annotations:
7+
{{- toYaml . | nindent 4 }}
8+
{{- end }}
9+
spec:
10+
ingressClassName: {{ .Values.ingress.ingressClassName }}
11+
tls:
12+
- hosts:
13+
- {{ .Values.ingress.host }}
14+
secretName: web-tls
15+
rules:
16+
- host: {{ .Values.ingress.host }}
17+
http:
18+
paths:
19+
- path: /
20+
pathType: Prefix
21+
backend:
22+
service:
23+
name: keycloak-http
24+
port:
25+
name: http

‎packages/system/keycloak/templates/init-script.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: keycloak-init-script
5+
data:
6+
init-realm.sh: |
7+
#!/bin/bash
8+
set -e
9+
10+
until curl -sSf http://localhost:8080/realms/master; do
11+
echo "Waiting for Keycloak to be ready..."
12+
sleep 5
13+
done
14+
15+
TOKEN=$(curl -s -X POST "http://localhost:8080/realms/master/protocol/openid-connect/token" \
16+
-H "Content-Type: application/x-www-form-urlencoded" \
17+
-d "username={{ .Values.user }}" \
18+
-d "password={{ .Values.password }}" \
19+
-d 'grant_type=password' \
20+
-d 'client_id=admin-cli' | jq -r '.access_token')
21+
22+
curl -s -X POST "http://localhost:8080/admin/realms" \
23+
-H "Authorization: Bearer $TOKEN" \
24+
-H "Content-Type: application/json" \
25+
-d '{
26+
"realm": "cozy",
27+
"enabled": true
28+
}'
29+
30+
echo "Realm 'cozy' created successfully."

‎packages/system/keycloak/templates/service-headless.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keycloak-headless
5+
spec:
6+
type: ClusterIP
7+
clusterIP: None
8+
selector:
9+
app: keycloak-ha

‎packages/system/keycloak/templates/service.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keycloak-http
5+
spec:
6+
type: ClusterIP
7+
ports:
8+
- name: http
9+
port: 8080
10+
protocol: TCP
11+
selector:
12+
app: keycloak-ha

‎packages/system/keycloak/templates/sts.yaml

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
apiVersion: apps/v1
2+
kind: StatefulSet
3+
metadata:
4+
name: keycloak
5+
labels:
6+
app: keycloak-ha
7+
spec:
8+
selector:
9+
matchLabels:
10+
app: keycloak-ha
11+
replicas: 2
12+
serviceName: keycloak-headless
13+
podManagementPolicy: Parallel
14+
updateStrategy:
15+
type: RollingUpdate
16+
template:
17+
metadata:
18+
labels:
19+
app: keycloak-ha
20+
spec:
21+
restartPolicy: Always
22+
securityContext:
23+
fsGroup: 1000
24+
containers:
25+
- name: keycloak
26+
image: {{ .Values.image }}
27+
imagePullPolicy: Always
28+
{{- if or .Values.resources.requests .Values.resources.limits }}
29+
resources:
30+
{{- if .Values.resources.limits }}
31+
limits:
32+
{{- toYaml .Values.resources.limits | nindent 14 }}
33+
{{- end }}
34+
{{- if .Values.resources.requests }}
35+
requests:
36+
{{- toYaml .Values.resources.requests | nindent 14 }}
37+
{{- end }}
38+
{{- end }}
39+
securityContext:
40+
runAsNonRoot: true
41+
runAsUser: 1000
42+
capabilities:
43+
drop:
44+
- ALL
45+
- CAP_NET_RAW
46+
readOnlyRootFilesystem: false
47+
allowPrivilegeEscalation: false
48+
args:
49+
- start
50+
env:
51+
- name: KC_METRICS_ENABLED
52+
value: "true"
53+
- name: KC_LOG_LEVEL
54+
value: "info"
55+
- name: KC_CACHE
56+
value: "ispn"
57+
- name: KC_CACHE_STACK
58+
value: "kubernetes"
59+
- name: KC_PROXY
60+
value: "edge"
61+
- name: KEYCLOAK_ADMIN
62+
value: {{ .Values.user }}
63+
- name: KEYCLOAK_ADMIN_PASSWORD
64+
value: {{ .Values.password }}
65+
- name: KC_DB
66+
value: "postgres"
67+
- name: KC_DB_URL_HOST
68+
value: "postgres-keycloak-rw"
69+
- name: KC_DB_URL_PORT
70+
value: "5432"
71+
- name: KC_DB_USERNAME
72+
valueFrom:
73+
value: keycloak
74+
- name: KC_DB_PASSWORD
75+
valueFrom:
76+
secretKeyRef:
77+
name: postgres-keycloak-credentials
78+
key: "keycloak"
79+
- name: KC_DB_URL_DATABASE
80+
value: keycloak
81+
- name: KC_FEATURES
82+
value: "docker"
83+
- name: KC_HOSTNAME
84+
value: {{ .Values.ingress.host }}
85+
- name: JAVA_OPTS_APPEND
86+
value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc.cozy.local"
87+
ports:
88+
- name: http
89+
containerPort: 8080
90+
protocol: TCP
91+
livenessProbe:
92+
httpGet:
93+
path: /
94+
port: http
95+
initialDelaySeconds: 120
96+
timeoutSeconds: 5
97+
readinessProbe:
98+
httpGet:
99+
path: /realms/master
100+
port: http
101+
initialDelaySeconds: 60
102+
timeoutSeconds: 1
103+
lifecycle:
104+
postStart:
105+
exec:
106+
command: ["/bin/bash", "-c", "if [[ $(HOSTNAME) == *-0 ]]; then /scripts/init-realm.sh; fi"]
107+
volumes:
108+
- name: init-script
109+
configMap:
110+
name: keycloak-init-script
111+
volumeMounts:
112+
- name: init-script
113+
mountPath: /scripts
114+
readOnly: true
115+
terminationGracePeriodSeconds: 60

‎packages/system/keycloak/values.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
image: quay.io/keycloak/keycloak:26.0.4
2+
host: keycloak.infra.aenix.org
3+
user: admin
4+
password: "{{ randAlphaNum 16 }}"
5+
6+
ingress:
7+
host: keycloak.example.com
8+
issuer: letsencrypt-prod
9+
ingressClassName: tenent-root
10+
annotations:
11+
acme.cert-manager.io/http01-ingress-class: tenant-root
12+
cert-manager.io/cluster-issuer: letsencrypt-prod
13+
nginx.ingress.kubernetes.io/affinity: "cookie"
14+
nginx.ingress.kubernetes.io/session-cookie-expires: "86400"
15+
nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
16+
nginx.ingress.kubernetes.io/session-cookie-name: "keycloak-cookie"
17+
18+
resources:
19+
limits:
20+
memory: 1500Mi
21+
requests:
22+
memory: 500Mi
23+
cpu: 100m

‎packages/system/postgres-instance/Chart.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-postgres-keycloak
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

‎packages/system/postgres-instance/templates/cluster.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: postgresql.cnpg.io/v1
3+
kind: Cluster
4+
metadata:
5+
name: {{ .Release.Name }}
6+
spec:
7+
instances: {{ .Values.replicas }}
8+
enableSuperuserAccess: true
9+
monitoring:
10+
enablePodMonitor: true
11+
storage:
12+
size: {{ required ".Values.size is required" .Values.size }}
13+
{{- with .Values.storageClass }}
14+
storageClass: {{ . }}
15+
{{- end }}
16+
inheritedMetadata:
17+
labels:
18+
policy.cozystack.io/allow-to-apiserver: "true"

0 commit comments

Comments
 (0)