Skip to content

Commit bf472fb

Browse files
kvapskvaps
authored
[keycloak-operator] Update to v1.32.0 (#2206)
## What this PR does Updates the Keycloak Operator Helm chart to v1.32.0 and builds a custom operator image from upstream master (epam/edp-keycloak-operator@facbc36) with the group rename detection patch from PR epam/edp-keycloak-operator#309 applied on top. Bumps Keycloak server from 26.0.4 to 26.5.2, which is required by the new operator client (sends `description` field rejected by older versions). Adds SSO session settings (idleTimeout: 86400, maxLifespan: 604800) to the ClusterKeycloakRealm to match the dashboard client's session attributes, as Keycloak 26 enforces realm-level session limits strictly. Removes `authorizationServicesEnabled` from the dashboard KeycloakClient, which is incompatible with Keycloak 26's stricter validation. ### Release note ```release-note [keycloak-operator] Update the operator to v1.32.0 with group rename fix (epam/edp-keycloak-operator#309). Bump Keycloak to 26.5.2. ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Optional webhook support with cert-manager integration and webhook service; feature toggles for webhooks and owner refs * New realm login and session settings, organizations resource/CRD, and expanded client/user schemas (including ClientRolesV2) * **Documentation** * Chart bumped to 1.32.0; README documents new values (clusterDomain, podLabels, image.registry, securityContext, containerSecurityContext) * **Security / RBAC** * RBAC updated to cover organization resources and webhook bindings; consolidated operator permissions <!-- end of auto-generated comment: release notes by coderabbit.ai -->
2 parents 5e77348 + cfd57f8 commit bf472fb

41 files changed

Lines changed: 1540 additions & 444 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/system/dashboard/templates/keycloakclient.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ spec:
5757
kind: ClusterKeycloakRealm
5858
secret: $dashboard-client:client-secret-key
5959
advancedProtocolMappers: true
60-
authorizationServicesEnabled: true
6160
name: dashboard
6261
clientId: dashboard
6362
directAccess: true

‎packages/system/keycloak-configure/templates/configure-kk.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ spec:
3737
displayHtmlName: {{ $brandingConfig.branding }}
3838
{{- end }}
3939
{{- end }}
40+
sessions:
41+
ssoSessionSettings:
42+
idleTimeout: 86400
43+
maxLifespan: 604800
4044

4145
---
4246

‎packages/system/keycloak-operator/Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,17 @@ export NAMESPACE=cozy-keycloak
44
include ../../../hack/common-envs.mk
55
include ../../../hack/package.mk
66

7+
image:
8+
docker buildx build images/keycloak-operator \
9+
--tag $(REGISTRY)/keycloak-operator:$(call settag,$(TAG)) \
10+
--cache-from type=registry,ref=$(REGISTRY)/keycloak-operator:latest \
11+
--cache-to type=inline \
12+
--metadata-file images/keycloak-operator.json \
13+
$(BUILDX_ARGS)
14+
TAG="$(call settag,$(TAG))@$$(yq e '."containerimage.digest"' images/keycloak-operator.json -r)" \
15+
yq -i '.keycloak-operator.image.tag = strenv(TAG)' values.yaml
16+
rm -f images/keycloak-operator.json
17+
718
update:
819
rm -rf charts
920
helm repo add epamedp https://epam.github.io/edp-helm-charts/stable

‎packages/system/keycloak-operator/charts/keycloak-operator/Chart.yaml‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -157,30 +157,29 @@ annotations:
157157
- apiVersion: v1.edp.epam.com/v1
158158
kind: KeycloakRealmIdentityProvider
159159
metadata:
160-
name: instagram-test
160+
name: github-test
161161
spec:
162162
realm: d2-id-k8s-realm-name
163-
alias: instagram
163+
alias: github
164164
authenticateByDefault: false
165165
enabled: true
166166
firstBrokerLoginFlowAlias: "first broker login"
167-
providerId: "instagram"
167+
providerId: "github"
168168
config:
169169
clientId: "foo"
170170
clientSecret: "bar"
171-
hideOnLoginPage: "true"
172171
syncMode: "IMPORT"
173172
useJwksUrl: "true"
174173
mappers:
175174
- name: "test3212"
176175
identityProviderMapper: "oidc-hardcoded-role-idp-mapper"
177-
identityProviderAlias: "instagram"
176+
identityProviderAlias: "github"
178177
config:
179178
role: "role-tr"
180179
syncMode: "INHERIT"
181180
- name: "test-33221"
182181
identityProviderMapper: "hardcoded-attribute-idp-mapper"
183-
identityProviderAlias: "instagram"
182+
identityProviderAlias: "github"
184183
config:
185184
attribute: "foo"
186185
"attribute.value": "bar"
@@ -272,8 +271,8 @@ annotations:
272271
secret: secret-name-in-operator-ns
273272
url: https://keycloak.example.com
274273
artifacthub.io/images: |
275-
- name: keycloak-operator:1.25.0
276-
image: epamedp/keycloak-operator:1.25.0
274+
- name: keycloak-operator:1.32.0
275+
image: epamedp/keycloak-operator:1.32.0
277276
artifacthub.io/license: Apache-2.0
278277
artifacthub.io/links: |
279278
- name: KubeRocketCI Documentation
@@ -283,7 +282,7 @@ annotations:
283282
artifacthub.io/operator: "true"
284283
artifacthub.io/operatorCapabilities: Deep Insights
285284
apiVersion: v2
286-
appVersion: 1.25.0
285+
appVersion: 1.32.0
287286
description: A Helm chart for KubeRocketCI Keycloak Operator
288287
home: https://docs.kuberocketci.io/
289288
icon: https://docs.kuberocketci.io/img/logo.svg
@@ -308,4 +307,4 @@ name: keycloak-operator
308307
sources:
309308
- https://github.com/epam/edp-keycloak-operator
310309
type: application
311-
version: 1.25.0
310+
version: 1.32.0

‎packages/system/keycloak-operator/charts/keycloak-operator/README.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# keycloak-operator
22

3-
![Version: 1.25.0](https://img.shields.io/badge/Version-1.25.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.25.0](https://img.shields.io/badge/AppVersion-1.25.0-informational?style=flat-square)
3+
![Version: 1.32.0](https://img.shields.io/badge/Version-1.32.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.32.0](https://img.shields.io/badge/AppVersion-1.32.0-informational?style=flat-square)
44

55
A Helm chart for KubeRocketCI Keycloak Operator
66

@@ -16,6 +16,7 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins
1616

1717
1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed;
1818
2. Cluster admin access to the cluster;
19+
3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`);
1920

2021
## Installation Using Helm Chart
2122

@@ -32,7 +33,7 @@ To install the Keycloak Operator, follow the steps below:
3233
```bash
3334
helm search repo epamedp/keycloak-operator -l
3435
NAME CHART VERSION APP VERSION DESCRIPTION
35-
epamedp/keycloak-operator 1.24.0 1.24.0 A Helm chart for KRCI Keycloak Operator
36+
epamedp/keycloak-operator 1.31.0 1.31.0 A Helm chart for KRCI Keycloak Operator
3637
```
3738

3839
_**NOTE:** It is highly recommended to use the latest stable version._
@@ -129,14 +130,21 @@ Development versions are also available from the [snapshot helm chart repository
129130
|-----|------|---------|-------------|
130131
| affinity | object | `{}` | Affinity for pod assignment |
131132
| annotations | object | `{}` | Annotations to be added to the Deployment |
133+
| clusterDomain | string | `"cluster.local"` | Cluster domain for constructing service DNS names |
132134
| clusterReconciliationEnabled | bool | `false` | If clusterReconciliationEnabled is true, the operator reconciles all Keycloak instances in the cluster; otherwise, it only reconciles instances in the same namespace by default, and cluster-scoped resources are ignored. |
135+
| containerSecurityContext | object | `{"allowPrivilegeEscalation":false}` | Container Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
136+
| enableOwnerRef | bool | `true` | If set to true, the operator will set the owner reference for all resources that have Keycloak or KeycloakRealm as reference. This is legacy behavior and not recommended for use. In the future, this will be set to false by default. |
137+
| enableWebhooks | bool | `true` | If set to true, enables webhook resources (ValidatingWebhookConfiguration, Service, and Certificate). Webhooks require cert-manager to be installed in the cluster. |
133138
| extraVolumeMounts | list | `[]` | Additional volumeMounts to be added to the container |
134139
| extraVolumes | list | `[]` | Additional volumes to be added to the pod |
140+
| image.registry | string | `""` | KubeRocketCI keycloak-operator Docker image registry. |
135141
| image.repository | string | `"epamedp/keycloak-operator"` | KubeRocketCI keycloak-operator Docker image name. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator) |
136142
| image.tag | string | `nil` | KubeRocketCI keycloak-operator Docker image tag. The released image can be found on [Dockerhub](https://hub.docker.com/r/epamedp/keycloak-operator/tags) |
137143
| imagePullPolicy | string | `"IfNotPresent"` | If defined, a imagePullPolicy applied to the deployment |
138144
| imagePullSecrets | list | `[]` | If defined, imagePullSecrets are applied to deployment |
139145
| name | string | `"keycloak-operator"` | Application name string |
140146
| nodeSelector | object | `{}` | Node labels for pod assignment |
147+
| podLabels | object | `{}` | Labels to be added to the pod |
141148
| resources | object | `{"limits":{"memory":"192Mi"},"requests":{"cpu":"50m","memory":"64Mi"}}` | Resource limits and requests for the pod |
149+
| securityContext | object | `{"runAsNonRoot":true}` | Deployment Security Context Ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ |
142150
| tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints |

‎packages/system/keycloak-operator/charts/keycloak-operator/README.md.gotmpl‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ _**NOTE:** Operator is platform-independent, which is why there is a unified ins
1717

1818
1. Linux machine or Windows Subsystem for Linux instance with [Helm 3](https://helm.sh/docs/intro/install/) installed;
1919
2. Cluster admin access to the cluster;
20+
3. [cert-manager](https://cert-manager.io/docs/installation/) installed in the cluster (required for webhook functionality, can be disabled via `enableWebhooks: false`);
2021

2122
## Installation Using Helm Chart
2223

@@ -33,7 +34,7 @@ To install the Keycloak Operator, follow the steps below:
3334
```bash
3435
helm search repo epamedp/keycloak-operator -l
3536
NAME CHART VERSION APP VERSION DESCRIPTION
36-
epamedp/keycloak-operator 1.24.0 1.24.0 A Helm chart for KRCI Keycloak Operator
37+
epamedp/keycloak-operator 1.31.0 1.31.0 A Helm chart for KRCI Keycloak Operator
3738
```
3839

3940
_**NOTE:** It is highly recommended to use the latest stable version._

‎packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/clusterkeycloakrealm.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,25 @@ spec:
77
realmName: realm-sample1234
88
authenticationFlows:
99
browserFlow: browserFlow-sample
10+
login:
11+
userRegistration: true
12+
forgotPassword: true
13+
rememberMe: true
14+
emailAsUsername: false
15+
loginWithEmail: true
16+
duplicateEmails: false
17+
verifyEmail: true
18+
editUsername: false
19+
sessions:
20+
ssoLoginSettings:
21+
accessCodeLifespanLogin: 1800 # 30 minutes
22+
accessCodeLifespanUserAction: 300 # 5 minutes
23+
ssoSessionSettings:
24+
idleTimeout: 1800 # 30 minutes
25+
idleTimeoutRememberMe: 604800 # 7 days
26+
maxLifespan: 36000 # 10 hours
27+
maxLifespanRememberMe: 2592000 # 30 days
28+
ssoOfflineSessionSettings:
29+
idleTimeout: 2592000 # 30 days
30+
maxLifespan: 5184000 # 60 days
31+
maxLifespanEnabled: true

‎packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclient.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,16 @@ spec:
1414
webUrl: https://argocd.example.com
1515
adminUrl: https://admin.example.com
1616
homeUrl: /home/
17-
defaultClientScopes:
18-
- groups
1917
redirectUris:
2018
- /url1/*
2119
- /url2/*
20+
clientRolesV2:
21+
- name: roleA
22+
description: "Role A"
23+
associatedClientRoles:
24+
- roleB
25+
- name: roleB
26+
description: "Role B"
2227

2328
---
2429

‎packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakclientscope.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ spec:
88
name: keycloakrealm-sample
99
kind: KeycloakRealm
1010
description: "Group Membership"
11+
type: default
1112
protocol: openid-connect
1213
protocolMappers:
1314
- name: groups

‎packages/system/keycloak-operator/charts/keycloak-operator/_crd_examples/keycloakorganizationorganization.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# Organization with identity provider configuration
2+
apiVersion: v1.edp.epam.com/v1alpha1
3+
kind: KeycloakOrganization
4+
metadata:
5+
name: test-keycloak-organization
6+
namespace: default
7+
spec:
8+
name: "Test Organization"
9+
alias: "test-org"
10+
domains:
11+
- "example.com"
12+
- "test.com"
13+
redirectUrl: "https://example.com/redirect"
14+
description: "Test organization"
15+
attributes:
16+
department:
17+
- "engineering"
18+
- "qa"
19+
location:
20+
- "us-east"
21+
identityProviders:
22+
- alias: "test-org-idp"
23+
realmRef:
24+
kind: KeycloakRealm
25+
name: test-org-realm
26+
27+
---
28+
29+
apiVersion: v1.edp.epam.com/v1
30+
kind: KeycloakRealmIdentityProvider
31+
metadata:
32+
name: test-org-idp
33+
namespace: default
34+
spec:
35+
alias: "test-org-idp"
36+
enabled: true
37+
providerId: "github"
38+
realmRef:
39+
kind: KeycloakRealm
40+
name: test-org-realm
41+
config:
42+
clientId: "test-org-client-id"
43+
clientSecret: "test-org-client-secret"
44+
kc.org.domain: "example.com"
45+
kc.org.broker.redirect.mode.email-matches: "true"

0 commit comments

Comments
 (0)