helm-charts-hardened/examples/tornjak/keycloak

Deploy Tornjak with Authentication Enabled

This example demonstrates Tornjak's capability to control access to the Frontend Application using User Management via Keycloak.

Tested on:

• Keycloak Application Version - 24.0.3
• Keycloak Chart Version - 21.0.3

For more information regarding Tornjak User Management, please refer to the following documentation:

• Tornjak User Management
• Keycloak Configuration for Tornjak
• Detailed Blogs on Tornjak User Management

Note

This example works only with the Vanilla version of Kubernetes; it does not yet support Openshift.

As part of the exercise, an instance of Keycloak is deployed to illustrate how to manage users' access to Tornjak. Once enabled, the Tornjak UI will redirect all authentication calls to the Keycloak instance to obtain the correct credentials. Authorization is based on these credentials and occurs at the Tornjak application level.

Deploy Keycloak Instance (Authentication Service)

We will deploy the instance of Keycloak in a dedicated namespace

# If does not exist, create a namespace to deploy Keycloak
kubectl create namespace keycloak

Important

The example uses default userid and password (admin,admin). You must change these values by setting auth.adminUser and auth.adminPassword as shown below.

# Deploy most recent Keycloak instance as an authentication service
helm upgrade --install -n keycloak keycloak \
--values examples/tornjak/keycloak/values.yaml \
--set auth.adminUser=your-userid --set auth.adminPassword=your-password \
oci://registry-1.docker.io/bitnamicharts/keycloak --render-subchart-notes

Important

It is important to start the Tornjak service before starting Tornjak with authentication

The example below demonstrates port forward for local access. In cloud deployment scenario, enable Ingress to the Keycloak service accordingly.

# Start an auth Service [Keycloak] in separate terminal
kubectl -n keycloak port-forward service/keycloak 8080:80

See the helm Notes for more information about accessing Keycloak

Deploy SPIRE with Tornjak User Management Enabled

Please follow the instructions for deploying Tornjak with addition of the User Management values --values examples/tornjak/values-auth.yaml.

Important

Make sure Tornjak backend User Management issuer points to the correct Keycloak issuer URL. Which is in format http://<your-keycloakServicename>.<keycloak-namespace>:<your-keycloak-portnumber>/realms/tornjak. For the example above it will be: http://keycloak.keycloak:8080/realms/tornjak You can set the issuer URL using --set spire-server.tornjak.config.userManagement.issuer=http://tornjak.tornjak:8080/realms/tornjak

[!IMPORTANT] If audience is set, make sure the Tornjak backend audience is set correctly. You can set it using: --set spire-server.tornjak.config.userManagement.audience=your-audience

[!TIP] Keep in mind, when redeploying Tornjak, you might have to recreate port forwarding for that service.

The sample examples/tornjak/values-auth.yaml assumes local Keycloak deployment using port forwarding. When using Ingress, update the URLs accordingly.

Access Tornjak

Follow the standard steps for Accessing Tornjak