hopefully it will work now
Some checks are pending
Codespell / Check for spelling errors (push) Waiting to run
Some checks are pending
Codespell / Check for spelling errors (push) Waiting to run
This commit is contained in:
parent
2a6b10f007
commit
67a67174a5
21 changed files with 422 additions and 742 deletions
0
.history/ref-implementation/maniek_20241112110416.yml
Normal file
0
.history/ref-implementation/maniek_20241112110416.yml
Normal file
35
.history/ref-implementation/maniek_20241112110417.yml
Normal file
35
.history/ref-implementation/maniek_20241112110417.yml
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8200
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,41 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8200
|
||||
targetPort: 8200
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8200
|
||||
type: ClusterIP
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8200
|
||||
targetPort: 8200
|
||||
type: ClusterIP
|
||||
19
.history/ref-implementation/openbao_20241112110613.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110613.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
//repoURL: 'https://github.com/openbao/openbao.git'
|
||||
targetRevision: main
|
||||
path: "openbao"
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110615.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110615.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
# repoURL: 'https://github.com/openbao/openbao.git'
|
||||
targetRevision: main
|
||||
path: "openbao"
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110641.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110641.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: 'https://github.com/openbao/openbao.git'
|
||||
targetRevision: main
|
||||
path: "openbao"
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110645.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110645.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: cnoe://keycloak/manifests
|
||||
targetRevision: main
|
||||
path: "openbao"
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110651.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110651.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: cnoe://keycloak/manifests
|
||||
targetRevision: main
|
||||
path: "."
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110747.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110747.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: cnoe://keycloak/manifests
|
||||
targetRevision: HEAD
|
||||
path: "."
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
19
.history/ref-implementation/openbao_20241112110753.yaml
Normal file
19
.history/ref-implementation/openbao_20241112110753.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: argocd
|
||||
spec:
|
||||
destination:
|
||||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: cnoe://openbao/manifests
|
||||
targetRevision: HEAD
|
||||
path: "."
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
|
|
@ -8,9 +8,9 @@ spec:
|
|||
namespace: openbao
|
||||
server: "https://kubernetes.default.svc"
|
||||
source:
|
||||
repoURL: 'https://github.com/openbao/openbao.git'
|
||||
targetRevision: main
|
||||
path: "openbao"
|
||||
repoURL: cnoe://openbao/manifests
|
||||
targetRevision: HEAD
|
||||
path: "."
|
||||
project: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
|
|
|
|||
|
|
@ -1,30 +0,0 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: keycloak-ingress-localhost
|
||||
namespace: keycloak
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "100"
|
||||
spec:
|
||||
ingressClassName: "nginx"
|
||||
rules:
|
||||
- host: localhost
|
||||
http:
|
||||
paths:
|
||||
- path: /keycloak
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
- host: cnoe.localtest.me
|
||||
http:
|
||||
paths:
|
||||
- path: /keycloak
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: keycloak
|
||||
port:
|
||||
name: http
|
||||
|
|
@ -1,164 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: keycloak
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: keycloak
|
||||
labels:
|
||||
app: keycloak
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app: keycloak
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app: keycloak
|
||||
name: keycloak
|
||||
namespace: keycloak
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: keycloak
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: keycloak
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- start-dev
|
||||
env:
|
||||
- name: KEYCLOAK_ADMIN
|
||||
value: cnoe-admin
|
||||
- name: KEYCLOAK_LOGLEVEL
|
||||
value: ALL
|
||||
- name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY
|
||||
value: 'true'
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: keycloak-config
|
||||
image: quay.io/keycloak/keycloak:22.0.3
|
||||
name: keycloak
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /keycloak/realms/master
|
||||
port: 8080
|
||||
volumeMounts:
|
||||
- mountPath: /opt/keycloak/conf
|
||||
name: keycloak-config
|
||||
readOnly: true
|
||||
volumes:
|
||||
- configMap:
|
||||
name: keycloak-config
|
||||
name: keycloak-config
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
keycloak.conf: |
|
||||
# Database
|
||||
# The database vendor.
|
||||
db=postgres
|
||||
|
||||
# The username of the database user.
|
||||
db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres
|
||||
|
||||
# The proxy address forwarding mode if the server is behind a reverse proxy.
|
||||
proxy=edge
|
||||
|
||||
# hostname configuration
|
||||
hostname=cnoe.localtest.me
|
||||
hostname-port=8443
|
||||
http-relative-path=keycloak
|
||||
|
||||
# the admin url requires its own configuration to reflect correct url
|
||||
hostname-admin=cnoe.localtest.me:8443
|
||||
|
||||
hostname-debug=true
|
||||
|
||||
# this should only be allowed in development. NEVER in production.
|
||||
hostname-strict=false
|
||||
hostname-strict-backchannel=false
|
||||
|
||||
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app: postgresql
|
||||
name: postgresql
|
||||
namespace: keycloak
|
||||
spec:
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: postgres
|
||||
port: 5432
|
||||
selector:
|
||||
app: postgresql
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
labels:
|
||||
app: postgresql
|
||||
name: postgresql
|
||||
namespace: keycloak
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: postgresql
|
||||
serviceName: service-postgresql
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: postgresql
|
||||
spec:
|
||||
containers:
|
||||
- envFrom:
|
||||
- secretRef:
|
||||
name: keycloak-config
|
||||
image: docker.io/library/postgres:15.3-alpine3.18
|
||||
name: postgres
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgresdb
|
||||
resources:
|
||||
limits:
|
||||
memory: 500Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 300Mi
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: "500Mi"
|
||||
|
||||
|
|
@ -1,366 +0,0 @@
|
|||
# resources here are used to configure keycloak instance for SSO
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: keycloak-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: argocd
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: keycloak-config
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: config-job
|
||||
namespace: keycloak
|
||||
data:
|
||||
client-scope-groups-payload.json: |
|
||||
{
|
||||
"name": "groups",
|
||||
"description": "groups a user belongs to",
|
||||
"attributes": {
|
||||
"consent.screen.text": "Access to groups a user belongs to.",
|
||||
"display.on.consent.screen": "true",
|
||||
"include.in.token.scope": "true",
|
||||
"gui.order": ""
|
||||
},
|
||||
"type": "default",
|
||||
"protocol": "openid-connect"
|
||||
}
|
||||
group-admin-payload.json: |
|
||||
{"name":"admin"}
|
||||
group-base-user-payload.json: |
|
||||
{"name":"base-user"}
|
||||
group-mapper-payload.json: |
|
||||
{
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-group-membership-mapper",
|
||||
"name": "groups",
|
||||
"config": {
|
||||
"claim.name": "groups",
|
||||
"full.path": "false",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"userinfo.token.claim": "true"
|
||||
}
|
||||
}
|
||||
realm-payload.json: |
|
||||
{"realm":"cnoe","enabled":true}
|
||||
user-password.json: |
|
||||
{
|
||||
"temporary": false,
|
||||
"type": "password",
|
||||
"value": "${USER1_PASSWORD}"
|
||||
}
|
||||
user-user1.json: |
|
||||
{
|
||||
"username": "user1",
|
||||
"email": "",
|
||||
"firstName": "user",
|
||||
"lastName": "one",
|
||||
"requiredActions": [],
|
||||
"emailVerified": false,
|
||||
"groups": [
|
||||
"/admin"
|
||||
],
|
||||
"enabled": true
|
||||
}
|
||||
user-user2.json: |
|
||||
{
|
||||
"username": "user2",
|
||||
"email": "",
|
||||
"firstName": "user",
|
||||
"lastName": "two",
|
||||
"requiredActions": [],
|
||||
"emailVerified": false,
|
||||
"groups": [
|
||||
"/base-user"
|
||||
],
|
||||
"enabled": true
|
||||
}
|
||||
argo-client-payload.json: |
|
||||
{
|
||||
"protocol": "openid-connect",
|
||||
"clientId": "argo-workflows",
|
||||
"name": "Argo Workflows Client",
|
||||
"description": "Used for Argo Workflows SSO",
|
||||
"publicClient": false,
|
||||
"authorizationServicesEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"standardFlowEnabled": true,
|
||||
"frontchannelLogout": true,
|
||||
"attributes": {
|
||||
"saml_idp_initiated_sso_url_name": "",
|
||||
"oauth2.device.authorization.grant.enabled": false,
|
||||
"oidc.ciba.grant.enabled": false
|
||||
},
|
||||
"alwaysDisplayInConsole": false,
|
||||
"rootUrl": "",
|
||||
"baseUrl": "",
|
||||
"redirectUris": [
|
||||
"https://cnoe.localtest.me:8443/argo-workflows/oauth2/callback"
|
||||
],
|
||||
"webOrigins": [
|
||||
"/*"
|
||||
]
|
||||
}
|
||||
|
||||
backstage-client-payload.json: |
|
||||
{
|
||||
"protocol": "openid-connect",
|
||||
"clientId": "backstage",
|
||||
"name": "Backstage Client",
|
||||
"description": "Used for Backstage SSO",
|
||||
"publicClient": false,
|
||||
"authorizationServicesEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"standardFlowEnabled": true,
|
||||
"frontchannelLogout": true,
|
||||
"attributes": {
|
||||
"saml_idp_initiated_sso_url_name": "",
|
||||
"oauth2.device.authorization.grant.enabled": false,
|
||||
"oidc.ciba.grant.enabled": false
|
||||
},
|
||||
"alwaysDisplayInConsole": false,
|
||||
"rootUrl": "",
|
||||
"baseUrl": "",
|
||||
"redirectUris": [
|
||||
"https://cnoe.localtest.me:8443/api/auth/keycloak-oidc/handler/frame"
|
||||
],
|
||||
"webOrigins": [
|
||||
"/*"
|
||||
]
|
||||
}
|
||||
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: config
|
||||
namespace: keycloak
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
generateName: config
|
||||
spec:
|
||||
serviceAccountName: keycloak-config
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: keycloak-config
|
||||
secret:
|
||||
secretName: keycloak-config
|
||||
- name: config-payloads
|
||||
configMap:
|
||||
name: config-job
|
||||
containers:
|
||||
- name: kubectl
|
||||
image: docker.io/library/ubuntu:22.04
|
||||
volumeMounts:
|
||||
- name: keycloak-config
|
||||
readOnly: true
|
||||
mountPath: "/var/secrets/"
|
||||
- name: config-payloads
|
||||
readOnly: true
|
||||
mountPath: "/var/config/"
|
||||
command: ["/bin/bash", "-c"]
|
||||
args:
|
||||
- |
|
||||
#! /bin/bash
|
||||
|
||||
set -ex -o pipefail
|
||||
|
||||
apt -qq update && apt -qq install curl jq -y
|
||||
|
||||
ADMIN_PASSWORD=$(cat /var/secrets/KEYCLOAK_ADMIN_PASSWORD)
|
||||
USER1_PASSWORD=$(cat /var/secrets/USER_PASSWORD)
|
||||
|
||||
KEYCLOAK_URL=http://keycloak.keycloak.svc.cluster.local:8080/keycloak
|
||||
|
||||
KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \
|
||||
--data-urlencode "username=cnoe-admin" \
|
||||
--data-urlencode "password=${ADMIN_PASSWORD}" \
|
||||
--data-urlencode "grant_type=password" \
|
||||
--data-urlencode "client_id=admin-cli" \
|
||||
${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token | jq -e -r '.access_token')
|
||||
|
||||
set +e
|
||||
|
||||
curl --fail-with-body -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe" &> /dev/null
|
||||
if [ $? -eq 0 ]; then
|
||||
exit 0
|
||||
fi
|
||||
set -e
|
||||
|
||||
curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl"
|
||||
chmod +x kubectl
|
||||
|
||||
echo "creating cnoe realm and groups"
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/realm-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/client-scope-groups-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/group-admin-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/groups
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/group-base-user-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/groups
|
||||
|
||||
# Create scope mapper
|
||||
echo 'adding group claim to tokens'
|
||||
CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id')
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/group-mapper-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models
|
||||
|
||||
echo "creating test users"
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/user-user1.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/users
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/user-user2.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/users
|
||||
|
||||
USER1ID=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=one" | jq -r '.[0].id')
|
||||
USER2ID=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=two" | jq -r '.[0].id')
|
||||
|
||||
echo "setting user passwords"
|
||||
jq -r --arg pass ${USER1_PASSWORD} '.value = $pass' /var/config/user-password.json > /tmp/user-password-to-be-applied.json
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X PUT --data @/tmp/user-password-to-be-applied.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER1ID}/reset-password
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X PUT --data @/tmp/user-password-to-be-applied.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER2ID}/reset-password
|
||||
|
||||
echo "creating Argo Workflows client"
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/argo-client-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/clients
|
||||
|
||||
CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "argo-workflows") | .id')
|
||||
CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id')
|
||||
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
|
||||
|
||||
ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
|
||||
|
||||
echo "creating Backstage client"
|
||||
curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X POST --data @/var/config/backstage-client-payload.json \
|
||||
${KEYCLOAK_URL}/admin/realms/cnoe/clients
|
||||
|
||||
CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "backstage") | .id')
|
||||
|
||||
CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id')
|
||||
curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
|
||||
|
||||
BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
|
||||
-H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
|
||||
-X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
|
||||
|
||||
ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}')
|
||||
|
||||
ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
|
||||
|
||||
echo \
|
||||
"apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: keycloak-clients
|
||||
namespace: keycloak
|
||||
type: Opaque
|
||||
stringData:
|
||||
ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET}
|
||||
ARGO_WORKFLOWS_CLIENT_ID: argo-workflows
|
||||
ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN}
|
||||
BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET}
|
||||
BACKSTAGE_CLIENT_ID: backstage
|
||||
" > /tmp/secret.yaml
|
||||
|
||||
./kubectl apply -f /tmp/secret.yaml
|
||||
|
||||
35
ref-implementation/openbao/manifests/manifest.yml
Normal file
35
ref-implementation/openbao/manifests/manifest.yml
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: openbao
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: openbao
|
||||
spec:
|
||||
containers:
|
||||
- name: openbao
|
||||
image: openbao/openbao:latest # Replace with the actual image
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: openbao
|
||||
namespace: openbao
|
||||
spec:
|
||||
selector:
|
||||
app: openbao
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8200
|
||||
targetPort: 8200
|
||||
type: ClusterIP
|
||||
|
|
@ -1,179 +0,0 @@
|
|||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
metadata:
|
||||
name: keycloak
|
||||
namespace: keycloak
|
||||
spec:
|
||||
length: 36
|
||||
digits: 5
|
||||
symbols: 5
|
||||
symbolCharacters: "/-+"
|
||||
noUpper: false
|
||||
allowRepeat: true
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: keycloak-config
|
||||
namespace: keycloak
|
||||
spec:
|
||||
refreshInterval: "0"
|
||||
target:
|
||||
name: keycloak-config
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
cnoe.io/cli-secret: "true"
|
||||
cnoe.io/package-name: keycloak
|
||||
engineVersion: v2
|
||||
data:
|
||||
KEYCLOAK_ADMIN_PASSWORD: "{{.KEYCLOAK_ADMIN_PASSWORD}}"
|
||||
KC_DB_USERNAME: keycloak
|
||||
KC_DB_PASSWORD: "{{.KC_DB_PASSWORD}}"
|
||||
POSTGRES_DB: keycloak
|
||||
POSTGRES_USER: keycloak
|
||||
POSTGRES_PASSWORD: "{{.KC_DB_PASSWORD}}"
|
||||
USER_PASSWORD: "{{.USER_PASSWORD}}"
|
||||
dataFrom:
|
||||
- sourceRef:
|
||||
generatorRef:
|
||||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
name: keycloak
|
||||
rewrite:
|
||||
- transform:
|
||||
template: "KEYCLOAK_ADMIN_PASSWORD"
|
||||
- sourceRef:
|
||||
generatorRef:
|
||||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
name: keycloak
|
||||
rewrite:
|
||||
- transform:
|
||||
template: "KC_DB_PASSWORD"
|
||||
- sourceRef:
|
||||
generatorRef:
|
||||
apiVersion: generators.external-secrets.io/v1alpha1
|
||||
kind: Password
|
||||
name: keycloak
|
||||
rewrite:
|
||||
- transform:
|
||||
template: "USER_PASSWORD"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: eso-store
|
||||
namespace: keycloak
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
namespace: keycloak
|
||||
name: eso-store
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- selfsubjectrulesreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: eso-store
|
||||
namespace: keycloak
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: eso-store
|
||||
namespace: keycloak
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: eso-store
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: keycloak
|
||||
spec:
|
||||
provider:
|
||||
kubernetes:
|
||||
remoteNamespace: keycloak
|
||||
server:
|
||||
caProvider:
|
||||
type: ConfigMap
|
||||
name: kube-root-ca.crt
|
||||
namespace: keycloak
|
||||
key: ca.crt
|
||||
auth:
|
||||
serviceAccount:
|
||||
name: eso-store
|
||||
namespace: keycloak
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: eso-store
|
||||
namespace: gitea
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: eso-store
|
||||
namespace: gitea
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- authorization.k8s.io
|
||||
resources:
|
||||
- selfsubjectrulesreviews
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: eso-store
|
||||
namespace: gitea
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: eso-store
|
||||
namespace: gitea
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: eso-store
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: gitea
|
||||
spec:
|
||||
provider:
|
||||
kubernetes:
|
||||
remoteNamespace: gitea
|
||||
server:
|
||||
caProvider:
|
||||
type: ConfigMap
|
||||
name: kube-root-ca.crt
|
||||
namespace: gitea
|
||||
key: ca.crt
|
||||
auth:
|
||||
serviceAccount:
|
||||
name: eso-store
|
||||
namespace: gitea
|
||||
Loading…
Add table
Add a link
Reference in a new issue