Skip to content

Commit 7e7e90e

Browse files
klinch0klinch0
committed
add keycloak
1 parent 47bd46c commit 7e7e90e

File tree

15 files changed

+311
-3
lines changed

15 files changed

+311
-3
lines changed

‎packages/apps/tenant/templates/tenant.yaml

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,3 +88,57 @@ roleRef:
8888
kind: Role
8989
name: {{ include "tenant.name" . }}
9090
apiGroup: rbac.authorization.k8s.io
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1
93+
kind: Role
94+
metadata:
95+
name: cozy:{{ include "tenant.name" . }}-rw
96+
namespace: cozy-public
97+
rules:
98+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
99+
resources: ["*"]
100+
verbs: ["*"]
101+
- apiGroups: ["source.toolkit.fluxcd.io"]
102+
resources: ["helm.toolkit.fluxcd.io/v2"]
103+
verbs: ["*"]
104+
---
105+
apiVersion: rbac.authorization.k8s.io/v1
106+
kind: RoleBinding
107+
metadata:
108+
name: cozy:{{ include "tenant.name" . }}-rw
109+
namespace: cozy-public
110+
subjects:
111+
- kind: Group
112+
name: cozy:{{ include "tenant.name" . }}-rw
113+
apiGroup: rbac.authorization.k8s.io
114+
roleRef:
115+
kind: Role
116+
name: cozy:{{ include "tenant.name" . }}-rw
117+
apiGroup: rbac.authorization.k8s.io
118+
---
119+
apiVersion: rbac.authorization.k8s.io/v1
120+
kind: Role
121+
metadata:
122+
name: cozy:{{ include "tenant.name" . }}-ro
123+
namespace: cozy-public
124+
rules:
125+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
126+
resources: ["*"]
127+
verbs: ["get", "list", "watch"]
128+
- apiGroups: ["source.toolkit.fluxcd.io"]
129+
resources: ["helm.toolkit.fluxcd.io/v2"]
130+
verbs: ["get", "list", "watch"]
131+
---
132+
apiVersion: rbac.authorization.k8s.io/v1
133+
kind: RoleBinding
134+
metadata:
135+
name: cozy:{{ include "tenant.name" . }}-ro
136+
namespace: cozy-public
137+
subjects:
138+
- kind: Group
139+
name: cozy:{{ include "tenant.name" . }}-ro
140+
apiGroup: rbac.authorization.k8s.io
141+
roleRef:
142+
kind: Role
143+
name: cozy:{{ include "tenant.name" . }}-ro
144+
apiGroup: rbac.authorization.k8s.io

‎packages/core/installer/values.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
cozystack:
2-
image: ghcr.io/aenix-io/cozystack/cozystack:v0.18.0@sha256:8c0e75ca3c9cbc8289cff7955f83e6d52d077cbb0e1328e64a82026c7bea19b5
2+
image: kklinch0/cozystack:9.2.1@sha256:17a8c88cbc4a1805617420164dee90e0b71a92f6013ccf0909c609e829678bb8

‎packages/core/platform/bundles/distro-full.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,3 +174,9 @@ releases:
174174
namespace: cozy-external-secrets-operator
175175
optional: true
176176
dependsOn: [cilium]
177+
178+
- name: keycloak
179+
releaseName: keycloak
180+
chart: cozy-keycloak
181+
namespace: cozy-keycloak
182+
dependsOn: [postgres-operator]

‎packages/core/platform/bundles/distro-hosted.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,9 @@ releases:
124124
namespace: cozy-external-secrets-operator
125125
optional: true
126126
dependsOn: []
127+
128+
- name: keycloak
129+
releaseName: keycloak
130+
chart: cozy-keycloak
131+
namespace: cozy-keycloak
132+
dependsOn: [postgres-operator]

‎packages/core/platform/bundles/paas-full.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,9 @@ releases:
249249
namespace: cozy-external-secrets-operator
250250
optional: true
251251
dependsOn: [cilium,kubeovn]
252+
253+
- name: keycloak
254+
releaseName: keycloak
255+
chart: cozy-keycloak
256+
namespace: cozy-keycloak
257+
dependsOn: [postgres-operator]

‎packages/core/platform/bundles/paas-hosted.yaml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ releases:
1919
chart: cozy-cert-manager-crds
2020
namespace: cozy-cert-manager
2121
dependsOn: []
22-
22+
2323
- name: cozystack-api
2424
releaseName: cozystack-api
2525
chart: cozy-cozystack-api
@@ -145,3 +145,9 @@ releases:
145145
{{- end }}
146146
{{- end }}
147147
{{- end }}
148+
149+
- name: keycloak
150+
releaseName: keycloak
151+
chart: cozy-keycloak
152+
namespace: cozy-keycloak
153+
dependsOn: [postgres-operator]

‎packages/system/keycloak/Chart.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-keycloak
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

‎packages/system/keycloak/templates/db.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: postgresql.cnpg.io/v1
2+
kind: Cluster
3+
metadata:
4+
name: keycloak-db
5+
spec:
6+
instances: 2
7+
storage:
8+
size: 20Gi
9+
10+
inheritedMetadata:
11+
labels:
12+
policy.cozystack.io/allow-to-apiserver: "true"

‎packages/system/keycloak/templates/ingress.yaml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $host := index $cozyConfig.data "root-host" }}
3+
{{- $issuerType := (index $cozyConfig.data "clusterissuer") | default "http01" }}
4+
5+
{{- $rootns := lookup "v1" "Namespace" "" "tenant-root" }}
6+
{{- $ingress := index $rootns.metadata.annotations "namespace.cozystack.io/ingress" }}
7+
8+
apiVersion: networking.k8s.io/v1
9+
kind: Ingress
10+
metadata:
11+
name: keycloak-ingress
12+
{{- with .Values.ingress.annotations }}
13+
annotations:
14+
{{- if ne $issuerType "cloudflare" }}
15+
acme.cert-manager.io/http01-ingress-class: {{ $ingress }}
16+
{{- end }}
17+
cert-manager.io/cluster-issuer: letsencrypt-prod
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
20+
spec:
21+
ingressClassName: {{ $ingress }}
22+
tls:
23+
- hosts:
24+
- keycloak.{{ $host }}
25+
secretName: web-tls
26+
rules:
27+
- host: keycloak.{{ $host }}
28+
http:
29+
paths:
30+
- path: /
31+
pathType: Prefix
32+
backend:
33+
service:
34+
name: keycloak-http
35+
port:
36+
name: http

‎packages/system/keycloak/templates/service-headless.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keycloak-headless
5+
spec:
6+
type: ClusterIP
7+
clusterIP: None
8+
selector:
9+
app: keycloak-ha

‎packages/system/keycloak/templates/service.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keycloak-http
5+
spec:
6+
type: ClusterIP
7+
ports:
8+
- name: http
9+
port: 8080
10+
protocol: TCP
11+
selector:
12+
app: keycloak-ha

‎packages/system/keycloak/templates/sts.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{{- $cozyConfig := lookup "v1" "ConfigMap" "cozy-system" "cozystack" }}
2+
{{- $host := index $cozyConfig.data "root-host" }}
3+
{{- $password := randAlphaNum 16 -}}
4+
5+
apiVersion: v1
6+
kind: Secret
7+
metadata:
8+
name: {{ .Release.Name }}-credentials
9+
stringData:
10+
admin: {{ $password }}
11+
12+
---
13+
14+
apiVersion: apps/v1
15+
kind: StatefulSet
16+
metadata:
17+
name: keycloak
18+
labels:
19+
app: keycloak-ha
20+
spec:
21+
selector:
22+
matchLabels:
23+
app: keycloak-ha
24+
replicas: 2
25+
serviceName: keycloak-headless
26+
podManagementPolicy: Parallel
27+
updateStrategy:
28+
type: RollingUpdate
29+
template:
30+
metadata:
31+
labels:
32+
app: keycloak-ha
33+
spec:
34+
restartPolicy: Always
35+
securityContext:
36+
fsGroup: 1000
37+
containers:
38+
- name: keycloak
39+
image: {{ .Values.image }}
40+
imagePullPolicy: Always
41+
{{- if or .Values.resources.requests .Values.resources.limits }}
42+
resources:
43+
{{- if .Values.resources.limits }}
44+
limits:
45+
{{- toYaml .Values.resources.limits | nindent 14 }}
46+
{{- end }}
47+
{{- if .Values.resources.requests }}
48+
requests:
49+
{{- toYaml .Values.resources.requests | nindent 14 }}
50+
{{- end }}
51+
{{- end }}
52+
securityContext:
53+
runAsNonRoot: true
54+
runAsUser: 1000
55+
capabilities:
56+
drop:
57+
- ALL
58+
- CAP_NET_RAW
59+
readOnlyRootFilesystem: false
60+
allowPrivilegeEscalation: false
61+
args:
62+
- start
63+
env:
64+
- name: KC_METRICS_ENABLED
65+
value: "true"
66+
- name: KC_LOG_LEVEL
67+
value: "info"
68+
- name: KC_CACHE
69+
value: "ispn"
70+
- name: KC_CACHE_STACK
71+
value: "kubernetes"
72+
- name: KC_PROXY
73+
value: "edge"
74+
- name: KEYCLOAK_ADMIN
75+
value: {{ .Values.user }}
76+
- name: KEYCLOAK_ADMIN_PASSWORD
77+
value: {{ $password }}
78+
- name: KC_DB
79+
value: "postgres"
80+
- name: KC_DB_URL_HOST
81+
valueFrom:
82+
secretKeyRef:
83+
name: keycloak-db-app
84+
key: "host"
85+
- name: KC_DB_URL_PORT
86+
valueFrom:
87+
secretKeyRef:
88+
name: keycloak-db-app
89+
key: "port"
90+
- name: KC_DB_USERNAME
91+
valueFrom:
92+
secretKeyRef:
93+
name: keycloak-db-app
94+
key: "username"
95+
- name: KC_DB_PASSWORD
96+
valueFrom:
97+
secretKeyRef:
98+
name: keycloak-db-app
99+
key: "password"
100+
- name: KC_DB_URL_DATABASE
101+
valueFrom:
102+
secretKeyRef:
103+
name: keycloak-db-app
104+
key: "dbname"
105+
- name: KC_FEATURES
106+
value: "docker"
107+
- name: KC_HOSTNAME
108+
value: https://keycloak.{{ $host }}
109+
- name: JAVA_OPTS_APPEND
110+
value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc.cozy.local"
111+
ports:
112+
- name: http
113+
containerPort: 8080
114+
protocol: TCP
115+
livenessProbe:
116+
httpGet:
117+
path: /
118+
port: http
119+
initialDelaySeconds: 120
120+
timeoutSeconds: 5
121+
readinessProbe:
122+
httpGet:
123+
path: /realms/master
124+
port: http
125+
initialDelaySeconds: 60
126+
timeoutSeconds: 1
127+
volumes:
128+
- name: init-script
129+
configMap:
130+
name: keycloak-init-script
131+
volumeMounts:
132+
- name: init-script
133+
mountPath: /scripts
134+
readOnly: true
135+
terminationGracePeriodSeconds: 60

‎packages/system/keycloak/values.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
image: quay.io/keycloak/keycloak:26.0.4
2+
3+
ingress:
4+
annotations:
5+
nginx.ingress.kubernetes.io/affinity: "cookie"
6+
nginx.ingress.kubernetes.io/session-cookie-expires: "86400"
7+
nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
8+
nginx.ingress.kubernetes.io/session-cookie-name: "keycloak-cookie"
9+
resources:
10+
limits:
11+
memory: 1500Mi
12+
requests:
13+
memory: 500Mi
14+
cpu: 100m

‎scripts/installer.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ set -o pipefail
33
set -e
44

55
BUNDLE=$(set -x; kubectl get configmap -n cozy-system cozystack -o 'go-template={{index .data "bundle-name"}}')
6-
VERSION=7
6+
VERSION=8
77

88
run_migrations() {
99
if ! kubectl get configmap -n cozy-system cozystack-version; then

‎scripts/migrations/7

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/sh
2+
# Migration 7 --> 8
3+
4+
5+
host=$(kubectl get hr tenant-root -n tenant-root -o yaml | grep 'host:' | awk '{print $2}')
6+
kubectl patch configmap -n cozy-system cozystack --type merge -p "{\"data\":{\"root-host\":\"$host\"}}"
7+
8+
# Write version to cozystack-version config
9+
kubectl create configmap -n cozy-system cozystack-version --from-literal=version=8 --dry-run=client -o yaml | kubectl apply -f-

0 commit comments

Comments
 (0)