Merge branch 'main' into feat/quarkus-keycloak-proto

.github/workflows/publish-helm-chart.yml

@@ -7,6 +7,7 @@ on:
     paths:
       - "charts/**/Chart.yaml"
       - ".github/workflows/publish-helm-chart.yml"
+  workflow_dispatch:
 
 jobs:
   build-and-push-helm:

charts/keycloak/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: sso-keycloak
-version: 1.14.4
-appVersion: 7.6.25-build.1
+version: 1.15.2
+appVersion: 7.6.39-build.1
 description: Open Source Identity and Access Management For Modern Applications and Services
 dependencies:
   - name: patroni

charts/keycloak/README.md

@@ -67,6 +67,9 @@ The following table lists the configurable parameters of the Keycloak chart and
 | `tolerations`                      | toleration settings                                              | `[]`                                                                                       |
 | `affinity`                         | affinity settings                                                | `{}`                                                                                       |
 | `affinityTemplate`                 | a template string to use to generate the affinity settings       |                                                                                            |
+| `podDisruptionBudget.enabled`                 | does keycloak have a pod disruption budget | false  |
+| `podDisruptionBudget.minAvailable`            | min number of keycloak pods available      |        |
+| `podDisruptionBudget.maxUnavailable`          | max number of keycloak pods unavailable    |        |
 | `maintenancePage.enabled`          | deploy maintenance page app                                      | `false`                                                                                    |
 | `maintenancePage.active`           | forward incoming traffic to maintenance page app                 | `false`                                                                                    |
 | `maintenancePage.replicaCount`     | number of maintenance app pods to create                         | `1`                                                                                        |

charts/keycloak/templates/_helpers.tpl

@@ -82,3 +82,14 @@ Maintenance Selector labels
 app.kubernetes.io/name: {{ include "sso-keycloak.name" . }}-maintenance
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "sso-keycloak.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "sso-keycloak.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}

charts/keycloak/templates/deployment.yaml

@@ -22,6 +22,31 @@ spec:
       {{- end }}
       labels: {{ include "sso-keycloak.labels" . | nindent 8 }}
     spec:
+      initContainers:
+        - name: {{ .Chart.Name }}-init
+          image: openshift/origin-cli:latest
+          command:
+            - "/bin/sh"
+            - "-c"
+            - |
+              namespace="{{ .Release.Namespace }}"
+              name={{ .Values.patroni.nameOverride }}
+              echo "Current Namespace: $namespace"
+              echo "Patroni Statefulset: $name"
+              check_master_ready(){
+                if kubectl -n $namespace  get pods -l app.kubernetes.io/name=$name,spilo-role=master -o custom-columns='ready:status.containerStatuses[*].ready' | grep true -c; then
+                  echo "Master pod is ready"
+                  return 0
+                else
+                  echo "Master pod is not ready"
+                  return 1
+                fi
+              }
+              while ! check_master_ready; do
+                echo "Waiting for master pod to be ready..."
+                sleep 5
+              done
+      serviceAccountName: {{ include "sso-keycloak.serviceAccountName" . }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/keycloak/templates/poddisruptionbudget.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ template "sso-keycloak.fullname" . }}-pdb
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+spec:
+  {{- if .Values.podDisruptionBudget.minAvailable }}
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  {{- else if .Values.podDisruptionBudget.maxUnavailable }}
+  maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+  {{- else }}
+  minAvailable: 0
+  {{- end }}
+  selector:
+    matchLabels: {{ include "sso-keycloak.selectorLabels" . | nindent 6 }}
+{{- end }}

charts/keycloak/templates/rbac.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+rules:
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs:
+  - get
+  - list
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs:
+  - get
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "sso-keycloak.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "sso-keycloak.fullname" . }}
+---
+{{- end }}

charts/keycloak/templates/serviceaccount.yaml

@@ -0,0 +1,7 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "sso-keycloak.fullname" . }}
+  labels: {{ include "sso-keycloak.labels" . | nindent 4 }}
+{{- end }}

charts/keycloak/values.yaml

@@ -117,6 +117,18 @@ affinityTemplate: |
         labelSelector:
           matchLabels: {{ include "sso-keycloak.selectorLabels" . | nindent 10 }}
 
+podDisruptionBudget:
+  enabled: false
+  minAvailable:
+  maxUnavailable:
+
+serviceAccount:
+  create: true
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
 patroni:
   replicaCount: 3
   # RH-SSO v7.5-9 is not tested with PostgreSQL 14

charts/patroni/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
 name: patroni
 description: "Highly available: HA PostgreSQL cluster."
-version: 1.5.2
-appVersion: 2.1-p5
+version: 1.6.0
+appVersion: 3.2-p1
 home: https://github.com/bcgov/sso-helm-charts/tree/main/charts/patroni
 sources:
   - https://github.com/zalando/patroni

charts/patroni/values.yaml

@@ -2,15 +2,15 @@ replicaCount: 3
 
 image:
   # see https://github.com/zalando/spilo/releases
-  repository: registry.opensource.zalan.do/acid/spilo-14
+  repository: ghcr.io/zalando/spilo-15
   pullPolicy: Always
-  tag: 2.1-p5
+  tag: 3.2-p1
 
 imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
-postgresMajorVersion: 14
+postgresMajorVersion: 15
 
 # Credentials used by Patroni
 credentials:

charts/saml-playground/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+name: saml-playground
+version: 1.0.0
+appVersion: 1.0.0
+description: SAML Playground built using NodeJS

charts/saml-playground/templates/_helpers.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "..name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "..fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "..chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

charts/saml-playground/templates/deployment.yaml

@@ -0,0 +1,40 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "..fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "..name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "..chart" . }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: {{ include "..name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: {{ include "..name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          env:
+            {{- range $key, $val := .Values.env }}
+            - name: {{  $key | quote | upper }}
+              value: {{ $val | quote }}
+            {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/saml-playground/templates/network-policy.yaml

@@ -0,0 +1,20 @@
+# see https://docs.openshift.com/container-platform/4.7/networking/network_policy/multitenant-network-policy.html#nw-networkpolicy-multitenant-isolation_multitenant-network-policy
+# only allow connections from the OpenShift Container Platform Ingress Controller.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-from-openshift-ingress-{{ include "..name" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "..name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "..chart" . }}
+spec:
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              policy-group.network.openshift.io/ingress: ""
+  podSelector: {}
+  policyTypes:
+    - Ingress

charts/saml-playground/templates/route.yaml

@@ -0,0 +1,23 @@
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: {{ include "..fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "..name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "..chart" . }}
+  annotations:
+    haproxy.router.openshift.io/balance: roundrobin
+    haproxy.router.openshift.io/disable_cookies: 'true'
+    haproxy.router.openshift.io/timeout: 120s
+spec:
+  {{- if .Values.route.host }}
+  host: {{ .Values.route.host }}
+  {{- end }}
+  tls:
+    insecureEdgeTerminationPolicy: Redirect
+    termination: edge
+  to:
+    kind: Service
+    name: {{ include "..fullname" . }}

charts/saml-playground/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "..fullname" . }}
+  labels:
+    app.kubernetes.io/name: {{ include "..name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    helm.sh/chart: {{ include "..chart" . }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      protocol: TCP
+      name: http
+      targetPort: http
+  selector:
+    app.kubernetes.io/name: {{ include "..name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}

charts/saml-playground/values.yaml

@@ -0,0 +1,28 @@
+replicaCount: 1
+
+image:
+  repository: ghcr.io/bcgov/pathfinder-sso/saml-playground
+  tag: dev
+  pullPolicy: Always
+
+nameOverride: saml-playground
+fullnameOverride: saml-playground
+
+service:
+  type: ClusterIP
+  port: 8080
+
+route:
+  host:
+
+env:
+  APP_URI: "https://saml-playground-c6af30-dev.apps.gold.devops.gov.bc.ca"
+  SERVER_PORT: 8080
+
+resources:
+  limits:
+    cpu: 50m
+    memory: 128Mi
+  requests:
+    cpu: 10m
+    memory: 64Mi