diff --git a/README.md b/README.md index f365334..d0cfc67 100644 --- a/README.md +++ b/README.md @@ -26,7 +26,6 @@ packages/ ├── system/ # Infrastructure & system packages │ ├── okdp-server/ │ ├── okdp-ui/ -│ ├── keycloak/ │ └── ... └── services/ # Services ├── superset/ diff --git a/packages/system/keycloak/keycloak.yaml b/packages/system/keycloak/keycloak.yaml deleted file mode 100644 index 0d4ff6b..0000000 --- a/packages/system/keycloak/keycloak.yaml +++ /dev/null @@ -1,294 +0,0 @@ -# -# Copyright 2026 The OKDP Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -# - -apiVersion: v1alpha1 -name: keycloak -tag: 24.4.11-p08 -protected: false -description: | - Keycloak identity and access management for Kubernetes -usage: - text: | - Keycloak provides centralized authentication and authorization. - Access the admin console at https://keycloak.{{ .Context.platform.ingress.suffix }} - Default admin credentials: admin/admin -schema: - parameters: - properties: - adminUser: - type: string - default: "admin" - description: "Keycloak admin username" - adminPassword: - type: string - default: "admin" - description: "Keycloak admin password" - memoryGi: - type: number - default: 2 - multipleOf: 0.25 - description: "Memory (GiB) used for Kubernetes requests. Limits are calculated as 2x the request." - cpu: - type: number - default: 0.5 - multipleOf: 0.25 - description: "CPU request in vCPU. Limits are calculated as 2x the request." - -modules: - - name: main - timeout: 10m - source: - oci: - repository: registry-1.docker.io/bitnamicharts/keycloak - tag: 24.4.11 - values: | - - {{- $namespace := printf "%v" .Release.spec.targetNamespace -}} - {{- $release := printf "%v" .Release.metadata.name -}} - {{- $domain := printf "%v" .Context.platform.ingress.suffix -}} - - {{- $databaseId := .Context.defaultIdp.settings.database.provider -}} - {{- $databaseProvider := (index .Context $databaseId).provider -}} - {{- $databaseHost := $databaseProvider.endpoints.host - | replace "{{ .Release.namespace }}" $namespace - | replace "{{ .Release.metadata.name }}" $release - | replace "{{ .Context.ingress.suffix }}" $domain -}} - {{- $databasePort := printf "%v" $databaseProvider.endpoints.port -}} - - {{- $databaseJdbcUrl := $databaseProvider.endpoints.jdbcUrl - | replace "{{ connection.host }}" $databaseHost - | replace "{{ connection.port }}" $databasePort - | replace "{{ dbName }}" .Context.defaultIdp.settings.database.name -}} - - global: - security: - allowInsecureImages: true - image: - registry: quay.io - repository: okdp/sandbox-images/keycloak - tag: 26.1.3-debian-12-r0 - ingress: - enabled: true - ingressClassName: "nginx" - annotations: - nginx.ingress.kubernetes.io/backend-protocol: "HTTP" - nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - cert-manager.io/cluster-issuer: "{{ .Context.platform.certificateIssuers.selfSigned.name }}" - tls: true - hostname: keycloak.{{ .Context.platform.ingress.suffix }} - - auth: - adminUser: "{{ .Parameters.adminUser }}" - adminPassword: "{{ .Parameters.adminPassword }}" - - postgresql: - enabled: false - externalDatabase: - host: "{{ $databaseHost }}" - port: "{{ $databasePort }}" - database: {{ .Context.defaultIdp.settings.database.name }} - extraEnvVars: - - name: KC_DB - value: 'postgres' - - name: KC_DB_URL - value: '{{ $databaseJdbcUrl }}' - - name: KC_DB_USERNAME - valueFrom: - secretKeyRef: - name: {{ .Context.defaultIdp.settings.database.credentialsSecret.name }} - key: {{ .Context.defaultIdp.settings.database.credentialsSecret.usernameKey }} - - name: KC_DB_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Context.defaultIdp.settings.database.credentialsSecret.name }} - key: {{ .Context.defaultIdp.settings.database.credentialsSecret.passwordKey }} - - name: KC_METRICS_ENABLED - value: "false" - - name: KC_TRACING_ENABLED - value: "false" - - name: KC_CACHE - value: "local" - - production: false - cache: - enabled: false - - resources: - requests: - cpu: "{{ mulf (float64 .Parameters.cpu) 1000 }}m" - memory: "{{ .Parameters.memoryGi }}Gi" - limits: - cpu: "{{ mulf (float64 .Parameters.cpu) 2 }}" - memory: "{{ mulf (float64 .Parameters.memoryGi) 2 }}Gi" - - keycloakConfigCli: - image: - registry: quay.io - repository: okdp/sandbox-images/keycloak-config-cli - tag: 6.4.0-debian-12-r0 - enabled: true - configuration: - master.json: | - { - "realm": "{{ .Context.defaultIdp.settings.realm.name }}", - "enabled": true, - "displayName": "{{ .Context.defaultIdp.settings.realm.displayName }}", - "users": [ - {{- range $index, $user := .Context.defaultIdp.settings.users }} - {{- if $index }},{{ end }} - { - "username": "{{ $user.username }}", - "enabled": true, - "emailVerified": true, - "email": "{{ $user.email }}", - "firstName": "{{ $user.firstName }}", - "lastName": "{{ $user.lastName }}", - {{- if $user.password }} - "credentials": [ - { - "type": "password", - "value": "{{ $user.password }}" - } - ], - {{- end }} - {{- if $user.serviceAccountClientId }} - "serviceAccountClientId": "{{ $user.serviceAccountClientId }}", - {{- end }} - "realmRoles": {{ toJson $user.roles }} - } - {{- end }} - ], - "groups": [ - {{- range $index, $group := .Context.defaultIdp.settings.groups }} - {{- if $index }},{{ end }} - { - "name": "{{ $group.name }}" - } - {{- end }} - ], - "roles": { - "realm": [ - {{- range $index, $role := .Context.defaultIdp.settings.roles }} - {{- if $index }},{{ end }} - { - "name": "{{ $role.name }}" - } - {{- end }} - ] - }, - "clients": [ - {{- range $index, $client := .Context.defaultIdp.settings.clients }} - {{- if $index }},{{ end }} - { - "clientId": "{{ $client.clientId }}", - "name": "{{ $client.name }}", - {{- if $client.publicClient }} - "publicClient": {{ $client.publicClient }}, - {{- else }} - "secret": "{{ $client.secret }}", - {{- end }} - "redirectUris": [ - {{- range $uriIndex, $uri := $client.redirectUris }} - {{- if $uriIndex }},{{ end }} - "{{ $uri | replace "{{ .Context.ingress.suffix }}" $.Context.platform.ingress.suffix }}" - {{- end }} - ], - "webOrigins": [ - {{- range $originIndex, $origin := $client.webOrigins }} - {{- if $originIndex }},{{ end }} - "{{ $origin | replace "{{ .Context.ingress.suffix }}" $.Context.platform.ingress.suffix }}" - {{- end }} - ] - {{- if $client.defaultClientScopes }}, - "defaultClientScopes": {{ toJson $client.defaultClientScopes }} - {{- end }} - {{- if $client.optionalClientScopes }}, - "optionalClientScopes": {{ toJson $client.optionalClientScopes }} - {{- end }} - {{- if $client.serviceAccountsEnabled }}, - "serviceAccountsEnabled": {{ $client.serviceAccountsEnabled }} - {{- end }} - {{- if hasKey $client "standardFlowEnabled" }}, - "standardFlowEnabled": {{ $client.standardFlowEnabled }} - {{- end }} - {{- if hasKey $client "implicitFlowEnabled" }}, - "implicitFlowEnabled": {{ $client.implicitFlowEnabled }} - {{- end }} - {{- if hasKey $client "directAccessGrantsEnabled" }}, - "directAccessGrantsEnabled": {{ $client.directAccessGrantsEnabled }} - {{- end }} - } - {{- end }} - ], - "clientScopes": [ - {{- range $index, $scope := .Context.defaultIdp.settings.clientScopes }} - {{- if $index }},{{ end }} - { - "id": "{{ $scope.name }}-scope-id", - "name": "{{ $scope.name }}", - "description": "{{ $scope.description }}", - "protocol": "{{ $scope.protocol }}", - "attributes": { - {{- $attrKeys := keys $scope.attributes | sortAlpha }} - {{- range $attrIndex, $key := $attrKeys }} - {{- if $attrIndex }},{{ end }} - "{{ $key }}": "{{ index $scope.attributes $key }}" - {{- end }} - }, - "protocolMappers": [ - {{- range $mapperIndex, $mapper := $scope.protocolMappers }} - {{- if $mapperIndex }},{{ end }} - { - "id": "{{ $mapper.name }}-mapper-id", - "name": "{{ $mapper.name }}", - "protocol": "{{ $mapper.protocol }}", - "protocolMapper": "{{ $mapper.protocolMapper }}", - "consentRequired": false, - "config": { - {{- $configKeys := keys $mapper.config | sortAlpha }} - {{- range $configIndex, $key := $configKeys }} - {{- if $configIndex }},{{ end }} - "{{ $key }}": "{{ index $mapper.config $key }}" - {{- end }} - } - } - {{- end }} - ] - } - {{- end }} - ], - "accessTokenLifespan": {{ .Context.defaultIdp.settings.realm.accessTokenLifespan }}, - "components": { - "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [ - { - "name": "Trusted Hosts", - "providerId": "trusted-hosts", - "subType": "anonymous", - "config": { - "host-sending-registration-request-must-match": ["true"], - "client-uris-must-match": ["true"], - "trusted-hosts": ["*.svc.cluster.local", "*.okdp.sandbox"] - } - } - ] - } - } -roles: - - identity -dependencies: - - external-secrets - - database-server - - ingress