Skip to content

Commit de1eb39

Browse files
simusimu
committed
Initial implementation for rendering Helm chart with some options
The current implementation allows configuring the following aspects of Keycloak: * The public hostname using either ingress or route * An initial admin user * Keycloak pod resource requests and limits * Additional Java options (JAVA_OPTS) * Prometheus monitoring using an existing prometheus-operator * Postgres database to use. By default a Bitnami Postgres is installed using the default storage class in the cluster. Note: Using an external database depends on Commodore support for making postprocessing filters optional, cf. projectsyn/commodore#155.
1 parent 84997b9 commit de1eb39

7 files changed

Lines changed: 163 additions & 4 deletions

File tree

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
helmcharts

‎class/defaults.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,57 @@
11
parameters:
22
keycloak:
33
namespace: syn-keycloak
4+
# Hostname should be overwritten on the cluster level
5+
hostname: keycloak.example.com
6+
# Keycloak Admin
7+
admin:
8+
secretname: keycloak-admin-user
9+
username: admin
10+
password: '?{vaultkv:${customer:name}/${cluster:name}/keycloak/admin-password}'
11+
# Ingress or Route should be enabled on the distribution level
12+
ingress:
13+
enabled: false
14+
route:
15+
enabled: false
16+
# Labels can be extended in the config hierarchy by providing further
17+
# entries in key `labels`.
18+
labels:
19+
app.kubernetes.io/name: keycloak
20+
app.kubernetes.io/instance: syn-keycloak
21+
app.kubernetes.io/version: v11.0.0
22+
app.kubernetes.io/component: keycloak
23+
app.kubernetes.io/managed-by: commodore
24+
# Pod resource requests and limits
25+
resources:
26+
requests:
27+
memory: "512Mi"
28+
cpu: "500m"
29+
limits:
30+
memory: "1Gi"
31+
cpu: "1"
32+
# Extra java opts are appended to the default options set in
33+
# `class/keycloak.yml`.
34+
extraJavaOpts: ""
35+
# Enable ServiceMonitor, PrometheusRule, and all Keycloak statistics on
36+
# the metrics endpoint by default.
37+
monitoring:
38+
enabled: true
39+
statistics: all
40+
# Use Bitnami Postgres installed by the Keycloak chart by default
41+
postgres:
42+
builtin: true
43+
external:
44+
secretname: keycloak-db-credentials
45+
address: postgres.example.com
46+
port: 5432
47+
database: keycloak
48+
user: keycloak
49+
password: '?{vaultkv:${customer:name}/${cluster:name}/keycloak/db-password}'
50+
charts:
51+
keycloak: '9.0.1'
52+
53+
# Using exports allows us to have expressions in the inventory
54+
exports:
55+
keycloak:
56+
postgres:
57+
builtin: ${keycloak:postgres:builtin}

‎class/keycloak.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
parameters:
22
kapitan:
3+
dependencies:
4+
- type: https
5+
source: 'https://github.com/codecentric/helm-charts/releases/download/keycloak-${keycloak:charts:keycloak}/keycloak-${keycloak:charts:keycloak}.tgz'
6+
unpack: true
7+
output_path: dependencies/keycloak/helmcharts
38
compile:
49
- input_paths:
510
- keycloak/component/app.jsonnet
@@ -9,3 +14,57 @@ parameters:
914
- keycloak/component/main.jsonnet
1015
input_type: jsonnet
1116
output_path: keycloak/
17+
- output_path: keycloak/01_keycloak_helmchart
18+
input_type: helm
19+
output_type: yaml
20+
input_paths:
21+
- keycloak/helmcharts/keycloak
22+
helm_values:
23+
statefulsetLabels: ${keycloak:labels}
24+
resources: ${keycloak:resources}
25+
# extraEnv *MUST* be a string, as it's fed through a templating
26+
# function.
27+
extraEnv: |
28+
- name: JAVA_OPTS
29+
value: >-
30+
-XX:+UseContainerSupport
31+
-XX:MaxRAMPercentage=50.0
32+
-Djava.net.preferIPv4Stack=true
33+
-Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS
34+
-Djava.awt.headless=true
35+
${keycloak:extraJavaOpts}
36+
- name: KEYCLOAK_STATISTICS
37+
value: ${keycloak:monitoring:statistics}
38+
extraEnvFrom: |
39+
- secretRef:
40+
name: ${keycloak:admin:secretname}
41+
- secretRef:
42+
name: $[ self:keycloak:postgres:external:secretname if exports:keycloak:postgres:builtin == false ]
43+
serviceAccount:
44+
labels: ${keycloak:labels}
45+
ingress:
46+
enabled: ${keycloak:ingress:enabled}
47+
labels: ${keycloak:labels}
48+
rules:
49+
- host: ${keycloak:hostname}
50+
tls:
51+
- host: ${keycloak:hostname}
52+
route:
53+
enabled: ${keycloak:route:enabled}
54+
labels: ${keycloak:labels}
55+
host: ${keycloak:hostname}
56+
service:
57+
labels: ${keycloak:labels}
58+
serviceMonitor:
59+
enabled: ${keycloak:monitoring:enabled}
60+
labels: ${keycloak:labels}
61+
prometheusRule:
62+
enabled: ${keycloak:monitoring:enabled}
63+
labels: ${keycloak:labels}
64+
postgresql:
65+
enabled: ${keycloak:postgres:builtin}
66+
master:
67+
labels: ${keycloak:labels}
68+
helm_params:
69+
release_name: keycloak
70+
namespace: '${keycloak:namespace}'

‎component/app.jsonnet‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,5 @@ local argocd = import 'lib/argocd.libjsonnet';
66
local app = argocd.App('keycloak', params.namespace);
77

88
{
9-
'keycloak': app,
9+
keycloak: app,
1010
}

‎component/main.jsonnet‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,32 @@ local inv = kap.inventory();
55
// The hiera parameters for the component
66
local params = inv.parameters.keycloak;
77

8+
local admin_secret = kube.Secret(params.admin.secretname) {
9+
metadata+: {
10+
labels+: params.labels,
11+
},
12+
stringData: {
13+
KEYCLOAK_USER: params.admin.username,
14+
KEYCLOAK_PASSWORD: params.admin.password,
15+
},
16+
};
17+
18+
local external_db_secret = kube.Secret(params.postgres.external.secretname) {
19+
metadata+: {
20+
labels+: params.labels,
21+
},
22+
stringData: {
23+
DB_VENDOR: 'postgres',
24+
DB_ADDR: params.postgres.external.address,
25+
DB_PORT: params.postgres.external.port,
26+
DB_DATABASE: params.postgres.external.database,
27+
DB_USER: params.postgres.external.user,
28+
DB_PASSWORD: params.postgres.external.password,
29+
},
30+
};
31+
832
// Define outputs below
933
{
34+
'10_admin_secret': admin_secret,
35+
[if params.postgres.builtin == false then '20_external_db_secret']: external_db_secret,
1036
}

‎docs/modules/ROOT/pages/index.adoc‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1-
= keycloak: A Commodore component to manage keycloak
1+
= keycloak: A Commodore component to manage Keycloak
22

3-
{doctitle} is a Commodore component for Managing keycloak.
3+
This component provides a set of tuned defaults and a simplified interface to
4+
deploy the https://hub.helm.sh/charts/codecentric/keycloak/9.0.1[Keycloak helm
5+
chart] on a Syn-enabled cluster.
6+
7+
The component defaults to provisioning a Bitnami Postgres database via the
8+
Keycloak helm chart, but this behavior can be overridden using the
9+
`keycloak.postgres` parameters exposed by the component.

‎postprocess/filters.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,14 @@
1-
filters: []
1+
filters:
2+
- path: keycloak/01_keycloak_helmchart/keycloak/templates
3+
type: builtin
4+
filter: helm_namespace
5+
filterargs:
6+
namespace: ${keycloak:namespace}
7+
create_namespace: 'true'
8+
- path: keycloak/01_keycloak_helmchart/keycloak/charts/postgresql/templates
9+
type: "builtin"
10+
# This will only work once Commodore PR#XXX has been merged
11+
enabled: ${keycloak:postgres:builtin}
12+
filter: helm_namespace
13+
filterargs:
14+
namespace: ${keycloak:namespace}

0 commit comments

Comments
 (0)