Add support for automated TLS certificates in Keycloak
This update introduces significant enhancements to the Keycloak chart, particularly regarding TLS certificate management. The changes include: - Added the capability to automatically generate and manage TLS certificates using Cert-Manager or Helm, improving the security posture by using self-signed certificates in development scenarios. - Implemented a dedicated ConfigMap to hold keycloak-config-cli configurations and ensured that it is integrated with the job for configuration synchronization. - Enhanced the handling of admin ingress settings and TLS secrets, facilitating smoother access and management for multi-host deployments. - Refactored and reorganized sections to improve readability and maintainability of templates, ensuring adherence to best practices in Helm charts. These improvements aim to streamline deployment, enhance security features, and simplify the management of certificates, facilitating easier Kubernetes operations for users.
This commit is contained in:
@@ -10,7 +10,7 @@ APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
Keycloak can be accessed through the following DNS name from within your cluster:
|
||||
|
||||
{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} (port {{ coalesce .Values.service.ports.http .Values.service.port }})
|
||||
{{ include "common.names.fullname" . }}.{{ include "common.names.namespace" . }}.svc.{{ .Values.clusterDomain }} (port {{ ternary .Values.service.ports.https .Values.service.ports.http .Values.tls.enabled }})
|
||||
|
||||
To access Keycloak from outside the cluster execute the following commands:
|
||||
|
||||
@@ -22,60 +22,33 @@ To access Keycloak from outside the cluster execute the following commands:
|
||||
echo "Keycloak URL: http{{ if .Values.ingress.tls }}s{{ end }}://{{ (tpl .Values.ingress.hostname .) }}/"
|
||||
echo "$CLUSTER_IP {{ (tpl .Values.ingress.hostname .) }}" | sudo tee -a /etc/hosts
|
||||
|
||||
{{- if .Values.adminIngress.enabled }}
|
||||
The admin area of Keycloak has been configured to point to a different domain ({{ .Values.adminIngress.hostname }}). Please remember to update the `frontendUrl` property of the `{{ .Values.adminRealm | default "master" }}` (or any other) realm for it to work properly (see README for an example) :
|
||||
|
||||
echo "Keycloak admin URL: http{{ if .Values.adminIngress.tls }}s{{ end }}://{{ (tpl .Values.adminIngress.hostname .) }}/"
|
||||
echo "$CLUSTER_IP {{ (tpl .Values.adminIngress.hostname .) }}" | sudo tee -a /etc/hosts
|
||||
{{- end }}
|
||||
|
||||
{{- else }}
|
||||
|
||||
1. Get the Keycloak URL by running these commands:
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
|
||||
export HTTP_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
{{- end }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].nodePort}" services {{ include "common.names.fullname" . }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
|
||||
echo "http://${NODE_IP}:${HTTP_NODE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://${NODE_IP}:${HTTPS_NODE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://${NODE_IP}:${NODE_PORT}/"
|
||||
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch its status by running 'kubectl get --namespace {{ include "common.names.namespace" . }} svc -w {{ include "common.names.fullname" . }}'
|
||||
|
||||
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- end }}
|
||||
export SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].port}" services {{ include "common.names.fullname" . }})
|
||||
export SERVICE_IP=$(kubectl get svc --namespace {{ include "common.names.namespace" . }} {{ include "common.names.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
|
||||
|
||||
echo "http://${SERVICE_IP}:${HTTP_SERVICE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://${SERVICE_IP}:${HTTPS_SERVICE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://${SERVICE_IP}:${SERVICE_PORT}/"
|
||||
|
||||
{{- else if contains "ClusterIP" .Values.service.type }}
|
||||
|
||||
export HTTP_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http')].port}" services {{ include "common.names.fullname" . }})
|
||||
{{- if .Values.tls.enabled }}
|
||||
export HTTPS_SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='https')].port}" services {{ include "common.names.fullname" . }})
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} ${HTTPS_SERVICE_PORT}:${HTTPS_SERVICE_PORT} &
|
||||
{{- else }}
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${HTTP_SERVICE_PORT}:${HTTP_SERVICE_PORT} &
|
||||
{{- end }}
|
||||
export SERVICE_PORT=$(kubectl get --namespace {{ include "common.names.namespace" . }} -o jsonpath="{.spec.ports[?(@.name=='http{{ if .Values.tls.enabled }}s{{ end }}')].port}" services {{ include "common.names.fullname" . }})
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ include "common.names.fullname" . }} ${SERVICE_PORT}:${SERVICE_PORT} &
|
||||
|
||||
echo "http://127.0.0.1:${HTTP_SERVICE_PORT}/"
|
||||
{{- if .Values.tls.enabled }}
|
||||
echo "https://127.0.0.1:${HTTPS_SERVICE_PORT}/"
|
||||
{{- end }}
|
||||
echo "http{{ if .Values.tls.enabled }}s{{ end }}://127.0.0.1:${SERVICE_PORT}/"
|
||||
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -85,7 +58,7 @@ The admin area of Keycloak has been configured to point to a different domain ({
|
||||
3. Access the Administration Console using the following credentials:
|
||||
|
||||
echo Username: {{ .Values.auth.adminUser }}
|
||||
echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keycloak.secretName" . }} -o jsonpath="{.data.{{ include "keycloak.secretKey" .}}}" | base64 -d)
|
||||
echo Password: $(kubectl get secret --namespace {{ include "common.names.namespace" . }} {{ include "keycloak.secretName" . }} -o jsonpath="{.data.{{ include "keycloak.secretKey" . }}}" | base64 -d)
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
|
||||
@@ -93,9 +66,9 @@ You can access the Prometheus metrics following the steps below:
|
||||
|
||||
1. Get the Keycloak Prometheus metrics URL by running:
|
||||
|
||||
{{- $metricsPort := coalesce .Values.metrics.service.ports.metrics .Values.metrics.service.port | toString }}
|
||||
{{- $metricsPort := .Values.metrics.service.ports.metrics | toString }}
|
||||
kubectl port-forward --namespace {{ include "common.names.namespace" . }} svc/{{ printf "%s-metrics" (include "common.names.fullname" .) }} {{ $metricsPort }}:{{ $metricsPort }} &
|
||||
echo "Keycloak Prometheus metrics URL: http://127.0.0.1:{{ $metricsPort }}/metrics"
|
||||
echo "Keycloak Prometheus metrics URL: http{{ if .Values.tls.enabled }}s{{ end }}://127.0.0.1:{{ $metricsPort }}/metrics"
|
||||
|
||||
2. Open a browser and access Keycloak Prometheus metrics using the obtained URL.
|
||||
|
||||
@@ -104,6 +77,6 @@ You can access the Prometheus metrics following the steps below:
|
||||
{{- include "keycloak.validateValues" . }}
|
||||
{{- include "common.warnings.rollingTag" .Values.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.keycloakConfigCli.image }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "keycloakConfigCli" "") "context" $) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" $) }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "" "keycloakConfigCli") "context" .) }}
|
||||
{{- include "common.warnings.modifiedImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" .) }}
|
||||
{{- include "common.errors.insecureImages" (dict "images" (list .Values.image .Values.keycloakConfigCli.image) "context" .) }}
|
||||
|
||||
Reference in New Issue
Block a user