Skip to content

Commit 975bb85

Browse files
unguiculusunguiculus
authored
Import Keycloak chart (codecentric#5)
Signed-off-by: Reinhard Nägele <[email protected]>
1 parent 65389c7 commit 975bb85

25 files changed

+1281
-0
lines changed

‎charts/keycloak/Chart.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: keycloak
2+
version: 4.10.2
3+
appVersion: 5.0.0
4+
description: Open Source Identity and Access Management For Modern Applications and Services
5+
keywords:
6+
- sso
7+
- idm
8+
- openid connect
9+
- saml
10+
- kerberos
11+
- ldap
12+
home: https://www.keycloak.org/
13+
icon: https://www.keycloak.org/resources/images/keycloak_logo_480x108.png
14+
sources:
15+
- https://github.com/jboss-dockerfiles/keycloak
16+
maintainers:
17+
- name: unguiculus
18+
email: [email protected]
19+
- name: thomasdarimont
20+
email: [email protected]

‎charts/keycloak/OWNERS

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
approvers:
2+
- unguiculus
3+
- thomasdarimont
4+
reviewers:
5+
- unguiculus
6+
- thomasdarimont

‎charts/keycloak/README.md

Lines changed: 323 additions & 0 deletions
Large diffs are not rendered by default.

‎charts/keycloak/ci/h2-values.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
keycloak:
2+
password: keycloak

‎charts/keycloak/ci/postgres-ha-values.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
keycloak:
2+
replicas: 2
3+
password: keycloak
4+
persistence:
5+
deployPostgres: true
6+
dbVendor: postgres

‎charts/keycloak/requirements.lock

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: postgresql
3+
repository: https://kubernetes-charts.storage.googleapis.com/
4+
version: 0.15.0
5+
digest: sha256:428d8302be9a566a3e77538af30c56b63e0bfc97dd01dd434f303f4434cb8100
6+
generated: 2018-07-06T08:41:15.715456938+02:00

‎charts/keycloak/requirements.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
dependencies:
2+
- name: postgresql
3+
version: 0.15.0
4+
repository: https://kubernetes-charts.storage.googleapis.com/
5+
condition: keycloak.persistence.deployPostgres

‎charts/keycloak/scripts/datasource.cli

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Configure datasource to use explicit query timeout in seconds
2+
/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=query-timeout,value=${env.DB_QUERY_TIMEOUT:300})
3+
4+
# Configure datasource to connection before use
5+
/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=validate-on-match,value=${env.DB_VALIDATE_ON_MATCH:true})
6+
7+
# Configure datasource to try all other connections before failing
8+
/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=use-fast-fail,value=${env.DB_USE_CAST_FAIL:false})

‎charts/keycloak/scripts/ha.cli

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=sessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
2+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=authenticationSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
3+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
4+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=clientSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
5+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=offlineClientSessions:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
6+
/subsystem=infinispan/cache-container=keycloak/distributed-cache=loginFailures:write-attribute(name=owners, value=${env.CACHE_OWNERS:2})
7+
8+
/subsystem=jgroups/channel=ee:write-attribute(name=stack, value=tcp)

‎charts/keycloak/scripts/logging.cli

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Allow log level to be configured via environment variable
2+
/subsystem=logging/console-handler=CONSOLE:write-attribute(name=level, value=${env.WILDFLY_LOGLEVEL:INFO})
3+
/subsystem=logging/root-logger=ROOT:write-attribute(name=level, value=${env.WILDFLY_LOGLEVEL:INFO})
4+
5+
# Add dedicated eventsListener config element to allow configuring elements.
6+
/subsystem=keycloak-server/spi=eventsListener:add()
7+
/subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:add(enabled=true)
8+
# Propagate success events to INFO instead of DEBUG, to expose successful logins for log analysis
9+
/subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:write-attribute(name=properties.success-level,value=info)
10+
/subsystem=keycloak-server/spi=eventsListener/provider=jboss-logging:write-attribute(name=properties.error-level,value=warn)

‎charts/keycloak/scripts/node-identifier.cli

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
## Sets the node identifier to the node name (= pod name). Node identifiers have to be unique. They can have a
2+
## maximum length of 23 characters. Thus, the chart's fullname template truncates its length accordingly.
3+
/subsystem=transactions:write-attribute(name=node-identifier, value=${jboss.node.name})

‎charts/keycloak/scripts/reverse-proxy.cli

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
/socket-binding-group=standard-sockets/socket-binding=proxy-https:add(port=443)
2+
/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket, value=proxy-https)
3+
/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding, value=true)

‎charts/keycloak/templates/NOTES.txt

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
2+
Keycloak can be accessed:
3+
4+
* Within your cluster, at the following DNS name at port {{ .Values.keycloak.service.port }}:
5+
6+
{{ template "keycloak.fullname" . }}-http.{{ .Release.Namespace }}.svc.cluster.local
7+
8+
{{- if .Values.keycloak.ingress.enabled }}
9+
10+
* From outside the cluster:
11+
12+
{{- range .Values.keycloak.ingress.hosts }}
13+
- http{{ if $.Values.keycloak.ingress.tls }}s{{ end }}://{{ . }}
14+
{{- end }}
15+
16+
{{- else }}
17+
18+
* From outside the cluster, run these commands in the same shell:
19+
20+
{{- if contains "NodePort" .Values.keycloak.service.type }}
21+
22+
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "keycloak.fullname" . }})
23+
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
24+
echo http://$NODE_IP:$NODE_PORT
25+
26+
{{- else if contains "LoadBalancer" .Values.keycloak.service.type }}
27+
28+
NOTE:
29+
It may take a few minutes for the LoadBalancer IP to be available.
30+
You can watch the status of by running 'kubectl get svc -w {{ template "keycloak.fullname" . }}'
31+
32+
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "keycloak.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
33+
echo http://$SERVICE_IP:{{ .Values.keycloak.service.port }}
34+
35+
{{- else if contains "ClusterIP" .Values.keycloak.service.type }}
36+
37+
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l app={{ template "keycloak.name" . }},release={{ .Release.Name }} -o jsonpath="{.items[0].metadata.name}")
38+
echo "Visit http://127.0.0.1:8080 to use Keycloak"
39+
kubectl port-forward --namespace {{ .Release.Namespace }} $POD_NAME 8080
40+
41+
{{- end }}
42+
43+
{{- end }}
44+
45+
{{- if .Release.IsInstall }}
46+
47+
Login with the following credentials:
48+
Username: {{ .Values.keycloak.username }}
49+
50+
To retrieve the initial user password run:
51+
kubectl get secret --namespace {{ .Release.Namespace }} {{ template "keycloak.fullname" . }}-http -o jsonpath="{.data.password}" | base64 --decode; echo
52+
{{- end }}

‎charts/keycloak/templates/_helpers.tpl

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "keycloak.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate to 20 characters because this is used to set the node identifier in WildFly which is limited to
12+
23 characters. This allows for a replica suffix for up to 99 replicas.
13+
*/}}
14+
{{- define "keycloak.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 20 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 20 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 20 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "keycloak.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Create a default fully qualified app name for the postgres requirement.
36+
*/}}
37+
{{- define "keycloak.postgresql.fullname" -}}
38+
{{- $postgresContext := dict "Values" .Values.postgresql "Release" .Release "Chart" (dict "Name" "postgresql") -}}
39+
{{ template "postgresql.fullname" $postgresContext }}
40+
{{- end -}}
41+
42+
{{/*
43+
Create the name for the database secret.
44+
*/}}
45+
{{- define "keycloak.externalDbSecret" -}}
46+
{{- if .Values.keycloak.persistence.existingSecret -}}
47+
{{- .Values.keycloak.persistence.existingSecret -}}
48+
{{- else -}}
49+
{{- template "keycloak.fullname" . -}}-db
50+
{{- end -}}
51+
{{- end -}}
52+
53+
{{/*
54+
Create the name for the password secret key.
55+
*/}}
56+
{{- define "keycloak.dbPasswordKey" -}}
57+
{{- if .Values.keycloak.persistence.existingSecret -}}
58+
{{- .Values.keycloak.persistence.existingSecretKey -}}
59+
{{- else -}}
60+
password
61+
{{- end -}}
62+
{{- end -}}
63+
64+
{{/*
65+
Create environment variables for database configuration.
66+
*/}}
67+
{{- define "keycloak.dbEnvVars" -}}
68+
{{- if .Values.keycloak.persistence.deployPostgres }}
69+
{{- if not (eq "postgres" .Values.keycloak.persistence.dbVendor) }}
70+
{{ fail (printf "ERROR: 'Setting keycloak.persistence.deployPostgres' to 'true' requires setting 'keycloak.persistence.dbVendor' to 'postgres' (is: '%s')!" .Values.keycloak.persistence.dbVendor) }}
71+
{{- end }}
72+
- name: DB_VENDOR
73+
value: postgres
74+
- name: DB_ADDR
75+
value: {{ template "keycloak.postgresql.fullname" . }}
76+
- name: DB_PORT
77+
value: "5432"
78+
- name: DB_DATABASE
79+
value: {{ .Values.postgresql.postgresDatabase | quote }}
80+
- name: DB_USER
81+
value: {{ .Values.postgresql.postgresUser | quote }}
82+
- name: DB_PASSWORD
83+
valueFrom:
84+
secretKeyRef:
85+
name: {{ template "keycloak.postgresql.fullname" . }}
86+
key: postgres-password
87+
{{- else }}
88+
- name: DB_VENDOR
89+
value: {{ .Values.keycloak.persistence.dbVendor | quote }}
90+
{{- if not (eq "h2" .Values.keycloak.persistence.dbVendor) }}
91+
- name: DB_ADDR
92+
value: {{ .Values.keycloak.persistence.dbHost | quote }}
93+
- name: DB_PORT
94+
value: {{ .Values.keycloak.persistence.dbPort | quote }}
95+
- name: DB_DATABASE
96+
value: {{ .Values.keycloak.persistence.dbName | quote }}
97+
- name: DB_USER
98+
value: {{ .Values.keycloak.persistence.dbUser | quote }}
99+
- name: DB_PASSWORD
100+
valueFrom:
101+
secretKeyRef:
102+
name: {{ template "keycloak.externalDbSecret" . }}
103+
key: {{ include "keycloak.dbPasswordKey" . | quote }}
104+
{{- end }}
105+
{{- end }}
106+
{{- end -}}

‎charts/keycloak/templates/configmap.yaml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{{- $highAvailability := gt (int .Values.keycloak.replicas) 1 -}}
2+
apiVersion: v1
3+
kind: ConfigMap
4+
metadata:
5+
name: {{ template "keycloak.fullname" . }}
6+
labels:
7+
app: {{ template "keycloak.name" . }}
8+
chart: {{ template "keycloak.chart" . }}
9+
release: "{{ .Release.Name }}"
10+
heritage: "{{ .Release.Service }}"
11+
data:
12+
keycloak.sh: |
13+
#!/usr/bin/env bash
14+
15+
set -eu
16+
17+
/opt/jboss/keycloak/bin/jboss-cli.sh --file=/scripts/keycloak.cli
18+
19+
{{- with .Values.keycloak.preStartScript }}
20+
echo 'Running custom pre-start script...'
21+
{{ . | indent 4 }}
22+
{{- end }}
23+
24+
exec /opt/jboss/tools/docker-entrypoint.sh -b 0.0.0.0 {{ .Values.keycloak.extraArgs }}{{- if $highAvailability }} -c standalone-ha.xml{{ else }} -c standalone.xml{{ end }}
25+
exit "$?"
26+
27+
keycloak.cli: |
28+
embed-server {{- if $highAvailability }} --server-config=standalone-ha.xml{{ end }} --std-out=echo
29+
batch
30+
31+
{{- if ne .Values.keycloak.basepath "auth" }}
32+
# Changes the base path to be /keycloak.basepath instead of /auth
33+
/subsystem=keycloak-server:write-attribute(name=web-context,value={{ if eq .Values.keycloak.basepath "" }}ROOT{{ else }}{{ .Values.keycloak.basepath }}{{ end }})
34+
{{- if eq .Values.keycloak.basepath "" }}
35+
/subsystem=undertow/server=default-server/host=default-host:write-attribute(name=default-web-module,value=keycloak-server.war)
36+
{{- end }}
37+
{{ end }}
38+
39+
{{- with .Values.keycloak.cli }}
40+
41+
{{ tpl .nodeIdentifier $ | indent 4 }}
42+
43+
{{ tpl .logging $ | indent 4 }}
44+
45+
{{ tpl .reverseProxy $ | indent 4 }}
46+
47+
{{ tpl .datasource $ | indent 4 }}
48+
49+
{{- if $highAvailability }}
50+
{{ tpl .ha $ | indent 4 }}
51+
{{- end }}
52+
53+
{{- with .custom }}
54+
{{ tpl . $ | indent 4 }}
55+
{{- end }}
56+
57+
{{- end }}
58+
59+
run-batch
60+
stop-embedded-server

‎charts/keycloak/templates/db-secret.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{{- if and (not .Values.keycloak.persistence.deployPostgres) (not .Values.keycloak.persistence.existingSecret) -}}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ template "keycloak.fullname" . }}-db
6+
labels:
7+
app: {{ template "keycloak.name" . }}
8+
chart: {{ template "keycloak.chart" . }}
9+
heritage: {{ .Release.Service }}
10+
release: {{ .Release.Name }}
11+
type: Opaque
12+
data:
13+
{{ template "keycloak.dbPasswordKey" . }}: {{ .Values.keycloak.persistence.dbPassword | b64enc | quote }}
14+
{{- end -}}

‎charts/keycloak/templates/headless-service.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- $highAvailability := gt (int .Values.keycloak.replicas) 1 -}}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ template "keycloak.fullname" . }}-headless
6+
labels:
7+
app: {{ template "keycloak.name" . }}
8+
chart: {{ template "keycloak.chart" . }}
9+
release: "{{ .Release.Name }}"
10+
heritage: "{{ .Release.Service }}"
11+
spec:
12+
type: ClusterIP
13+
clusterIP: None
14+
ports:
15+
- name: http
16+
port: {{ .Values.keycloak.service.port }}
17+
targetPort: http
18+
protocol: TCP
19+
{{- if $highAvailability }}
20+
- name: jgroups
21+
port: {{ .Values.keycloak.service.jgroupsPort }}
22+
targetPort: jgroups
23+
protocol: TCP
24+
{{- end }}
25+
selector:
26+
app: {{ template "keycloak.name" . }}
27+
release: "{{ .Release.Name }}"

‎charts/keycloak/templates/http-service.yaml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- $service := .Values.keycloak.service -}}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ template "keycloak.fullname" . }}-http
6+
{{- with $service.annotations }}
7+
annotations:
8+
{{ toYaml . | indent 4 }}
9+
{{- end }}
10+
labels:
11+
app: {{ template "keycloak.name" . }}
12+
chart: {{ template "keycloak.chart" . }}
13+
release: "{{ .Release.Name }}"
14+
heritage: "{{ .Release.Service }}"
15+
{{- with $service.labels }}
16+
{{ toYaml . | indent 4 }}
17+
{{- end }}
18+
spec:
19+
type: {{ $service.type }}
20+
ports:
21+
- name: http
22+
port: {{ $service.port }}
23+
targetPort: http
24+
{{- if and (eq "NodePort" $service.type) $service.nodePort }}
25+
nodePort: {{ $service.nodePort }}
26+
{{- end }}
27+
protocol: TCP
28+
selector:
29+
app: {{ template "keycloak.name" . }}
30+
release: "{{ .Release.Name }}"

0 commit comments

Comments
 (0)