Skip to content

Commit 0747acc

Browse files
klinch0klinch0
committed
add keycloak
1 parent bfbde07 commit 0747acc

18 files changed

Lines changed: 438 additions & 16 deletions

File tree

‎.pre-commit-config.yaml‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,4 @@
11
repos:
2-
- repo: https://github.com/pre-commit/pre-commit-hooks
3-
rev: v4.5.0
4-
hooks:
5-
- id: end-of-file-fixer
6-
- id: trailing-whitespace
7-
- id: mixed-line-ending
8-
args: [--fix=lf]
9-
- id: check-yaml
10-
exclude: '^.*templates/.*\.yaml$'
11-
args: [--unsafe]
12-
- repo: https://github.com/igorshubovych/markdownlint-cli
13-
rev: v0.42.0
14-
hooks:
15-
- id: markdownlint
16-
args: [--fix, --disable, MD013, MD041, --]
172
- repo: local
183
hooks:
194
- id: gen-versions-map

‎packages/apps/tenant/templates/tenant.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,3 +88,57 @@ roleRef:
8888
kind: Role
8989
name: {{ include "tenant.name" . }}
9090
apiGroup: rbac.authorization.k8s.io
91+
---
92+
apiVersion: rbac.authorization.k8s.io/v1
93+
kind: Role
94+
metadata:
95+
name: cozy:{{ include "tenant.name" . }}-rw
96+
namespace: cozy-public
97+
rules:
98+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
99+
resources: ["*"]
100+
verbs: ["*"]
101+
- apiGroups: ["source.toolkit.fluxcd.io"]
102+
resources: ["helm.toolkit.fluxcd.io/v2"]
103+
verbs: ["*"]
104+
---
105+
apiVersion: rbac.authorization.k8s.io/v1
106+
kind: RoleBinding
107+
metadata:
108+
name: cozy:{{ include "tenant.name" . }}-rw
109+
namespace: cozy-public
110+
subjects:
111+
- kind: Group
112+
name: cozy:{{ include "tenant.name" . }}-rw
113+
apiGroup: rbac.authorization.k8s.io
114+
roleRef:
115+
kind: Role
116+
name: cozy:{{ include "tenant.name" . }}-rw
117+
apiGroup: rbac.authorization.k8s.io
118+
---
119+
apiVersion: rbac.authorization.k8s.io/v1
120+
kind: Role
121+
metadata:
122+
name: cozy:{{ include "tenant.name" . }}-ro
123+
namespace: cozy-public
124+
rules:
125+
- apiGroups: ["apps.cozystack.io/v1alpha1"]
126+
resources: ["*"]
127+
verbs: ["get", "list", "watch"]
128+
- apiGroups: ["source.toolkit.fluxcd.io"]
129+
resources: ["helm.toolkit.fluxcd.io/v2"]
130+
verbs: ["get", "list", "watch"]
131+
---
132+
apiVersion: rbac.authorization.k8s.io/v1
133+
kind: RoleBinding
134+
metadata:
135+
name: cozy:{{ include "tenant.name" . }}-ro
136+
namespace: cozy-public
137+
subjects:
138+
- kind: Group
139+
name: cozy:{{ include "tenant.name" . }}-ro
140+
apiGroup: rbac.authorization.k8s.io
141+
roleRef:
142+
kind: Role
143+
name: cozy:{{ include "tenant.name" . }}-ro
144+
apiGroup: rbac.authorization.k8s.io

‎packages/core/platform/bundles/distro-full.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,3 +174,15 @@ releases:
174174
namespace: cozy-external-secrets-operator
175175
optional: true
176176
dependsOn: [cilium]
177+
178+
- name: postgres-instance
179+
releaseName: postgres-instance
180+
chart: cozy-postgres-instance
181+
namespace: cozy-keycloak
182+
dependsOn: [postgres-operator]
183+
184+
- name: keycloak
185+
releaseName: keycloak
186+
chart: cozy-keycloak
187+
namespace: cozy-keycloak
188+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/distro-hosted.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,3 +124,15 @@ releases:
124124
namespace: cozy-external-secrets-operator
125125
optional: true
126126
dependsOn: []
127+
128+
- name: postgres-instance
129+
releaseName: postgres-instance
130+
chart: cozy-postgres-instance
131+
namespace: cozy-keycloak
132+
dependsOn: [postgres-operator]
133+
134+
- name: keycloak
135+
releaseName: keycloak
136+
chart: cozy-keycloak
137+
namespace: cozy-keycloak
138+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/paas-full.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,3 +249,15 @@ releases:
249249
namespace: cozy-external-secrets-operator
250250
optional: true
251251
dependsOn: [cilium,kubeovn]
252+
253+
- name: postgres-instance
254+
releaseName: postgres-instance
255+
chart: cozy-postgres-instance
256+
namespace: cozy-keycloak
257+
dependsOn: [postgres-operator]
258+
259+
- name: keycloak
260+
releaseName: keycloak
261+
chart: cozy-keycloak
262+
namespace: cozy-keycloak
263+
dependsOn: [postgres-instance]

‎packages/core/platform/bundles/paas-hosted.yaml‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ releases:
1919
chart: cozy-cert-manager-crds
2020
namespace: cozy-cert-manager
2121
dependsOn: []
22-
22+
2323
- name: cozystack-api
2424
releaseName: cozystack-api
2525
chart: cozy-cozystack-api
@@ -145,3 +145,15 @@ releases:
145145
{{- end }}
146146
{{- end }}
147147
{{- end }}
148+
149+
- name: postgres-instance
150+
releaseName: postgres-instance
151+
chart: cozy-postgres-instance
152+
namespace: cozy-keycloak
153+
dependsOn: [postgres-operator]
154+
155+
- name: keycloak
156+
releaseName: keycloak
157+
chart: cozy-keycloak
158+
namespace: cozy-keycloak
159+
dependsOn: [postgres-instance]

‎packages/system/keycloak/Chart.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
apiVersion: v2
2+
name: cozy-keycloak
3+
version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

‎packages/system/keycloak/templates/ingress.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
name: keycloak-ingress
5+
{{- with .Values.ingress.Annotations }}
6+
annotations:
7+
{{- toYaml . | nindent 4 }}
8+
{{- end }}
9+
spec:
10+
ingressClassName: {{ .Values.ingress.ingressClassName }}
11+
tls:
12+
- hosts:
13+
- {{ .Values.ingress.host }}
14+
secretName: web-tls
15+
rules:
16+
- host: {{ .Values.ingress.host }}
17+
http:
18+
paths:
19+
- path: /
20+
pathType: Prefix
21+
backend:
22+
service:
23+
name: keycloak-http
24+
port:
25+
name: http

‎packages/system/keycloak/templates/init-script.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: keycloak-init-script
5+
data:
6+
init-realm.sh: |
7+
#!/bin/bash
8+
set -e
9+
10+
until curl -sSf http://localhost:8080/realms/master; do
11+
echo "Waiting for Keycloak to be ready..."
12+
sleep 5
13+
done
14+
15+
TOKEN=$(curl -s -X POST "http://localhost:8080/realms/master/protocol/openid-connect/token" \
16+
-H "Content-Type: application/x-www-form-urlencoded" \
17+
-d "username={{ .Values.user }}" \
18+
-d "password={{ .Values.password }}" \
19+
-d 'grant_type=password' \
20+
-d 'client_id=admin-cli' | jq -r '.access_token')
21+
22+
curl -s -X POST "http://localhost:8080/admin/realms" \
23+
-H "Authorization: Bearer $TOKEN" \
24+
-H "Content-Type: application/json" \
25+
-d '{
26+
"realm": "cozy",
27+
"enabled": true
28+
}'
29+
30+
echo "Realm 'cozy' created successfully."

‎packages/system/keycloak/templates/service-headless.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: keycloak-headless
5+
spec:
6+
type: ClusterIP
7+
clusterIP: None
8+
selector:
9+
app: keycloak-ha

0 commit comments

Comments
 (0)