Add example for using SPIRE for mTLS with Keycloak (#248)

* Add example for using Spire for mTLS with Keycloak Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Minor improvement to the README.md Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * But I still need to learn GitHub Markdown format Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Make it more obvious that it works without a (correct) password Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Add warning for Kubernetes 1.29+ feature Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move ghostunnel into an initContainer with restartPolicy=Always Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Apply suggestions from code review Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image Signed-off-by: Moritz Schmitz von Hülst <[email protected]> --------- Signed-off-by: Moritz Schmitz von Hülst <[email protected]> Co-authored-by: kfox1111 <[email protected]>
2024-02-19 04:33:01 -08:00
parent cc8ec897bf
commit 43a72a22ff
4 changed files with 311 additions and 0 deletions
@@ -0,0 +1,134 @@
+extraDeploy:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: java-spiffe-helper-properties
+    data:
+      java-spiffe-helper.properties: |
+        keyStorePath=/certs/keystore.p12
+        keyStorePass=password
+        keyPass=password
+        trustStorePath=/certs/truststore.p12
+        trustStorePass=password
+        keyStoreType=pkcs12
+        keyAlias=spiffe
+        spiffeSocketPath=unix:/run/spire/agent-sockets/spire-agent.sock
+service:
+  extraPorts:
+    - name: https
+      port: 8443
+      targetPort: 8443
+extraEnvVars:
+  - name: KC_HTTPS_CLIENT_AUTH
+    value: "request"
+  - name: KC_HTTPS_KEY_STORE_FILE
+    value: "/certs/keystore.p12"
+  - name: KC_HTTPS_KEY_STORE_PASSWORD
+    value: "password"
+  - name: KC_HTTPS_KEY_STORE_TYPE
+    value: "pkcs12"
+  - name: KC_HTTPS_TRUST_STORE_FILE
+    value: "/certs/truststore.p12"
+  - name: KC_HTTPS_TRUST_STORE_PASSWORD
+    value: "password"
+  - name: KC_HTTPS_TRUST_STORE_TYPE
+    value: "pkcs12"
+initContainers:
+  - name: java-spiffe-helper
+    image: ghcr.io/spiffe/java-spiffe-helper:0.8.5
+    imagePullPolicy: IfNotPresent
+    restartPolicy: Always
+    readinessProbe:
+      exec:
+        command:
+          - ls
+          - /certs/truststore.p12
+    volumeMounts:
+      - name: java-spiffe-helper-properties
+        mountPath: /app/java-spiffe-helper.properties
+        subPath: java-spiffe-helper.properties
+      - name: spire-sockets
+        mountPath: /run/spire/agent-sockets
+        readOnly: true
+      - name: certs
+        mountPath: /certs
+extraVolumeMounts:
+  - name: certs
+    mountPath: /certs
+extraVolumes:
+  - name: java-spiffe-helper-properties
+    configMap:
+      name: java-spiffe-helper-properties
+  - name: spire-sockets
+    hostPath:
+      path: /run/spire/agent-sockets
+      type: DirectoryOrCreate
+  - name: certs
+    emptyDir: {}
+auth:
+  adminPassword: "password"
+keycloakConfigCli:
+  enabled: true
+  configuration:
+    master.json: |
+      {
+        "id": "master",
+        "realm": "master",
+        "enabled": true,
+        "users": [
+          {
+            "username": "keycloak-config-cli",
+            "enabled": true,
+            "realmRoles": [
+              "admin"
+            ],
+            "credentials": [
+              {
+                "type": "password",
+                "value": "it-really-doesn't-matter-what-you-put-here"
+              }
+            ]
+          }
+        ],
+        "authenticationFlows": [
+          {
+            "alias": "direct grant x509",
+            "providerId": "basic-flow",
+            "topLevel": true,
+            "builtIn": false,
+            "authenticationExecutions": [
+              {
+                "authenticatorConfig": "username",
+                "authenticator": "direct-grant-auth-x509-username",
+                "requirement": "REQUIRED",
+                "priority": 0
+              }
+            ]
+          }
+        ],
+        "authenticatorConfig": [
+          {
+            "alias": "username",
+            "config": {
+              "x509-cert-auth.regular-expression": "CN=(keycloak-config-cli)",
+              "x509-cert-auth.mapper-selection": "Username or Email",
+              "x509-cert-auth.mapping-source-selection": "Match SubjectDN using regular expression"
+            }
+          }
+        ],
+        "clients": [
+          {
+            "clientId": "keycloak-config-cli",
+            "name": "keycloak-config-cli",
+            "enabled": true,
+            "standardFlowEnabled": false,
+            "directAccessGrantsEnabled": true,
+            "publicClient": true,
+            "authenticationFlowBindingOverrides": {
+              "direct_grant": "direct grant x509"
+            },
+            "fullScopeAllowed": true,
+            "nodeReRegistrationTimeout": 0
+          }
+        ]
+      }