Moritz Schmitz von Hülstandkfox1111
43a72a22ff
* Add example for using Spire for mTLS with Keycloak Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Minor improvement to the README.md Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * But I still need to learn GitHub Markdown format Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Make it more obvious that it works without a (correct) password Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Add warning for Kubernetes 1.29+ feature Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move ghostunnel into an initContainer with restartPolicy=Always Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Apply suggestions from code review Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image Signed-off-by: Moritz Schmitz von Hülst <[email protected]> --------- Signed-off-by: Moritz Schmitz von Hülst <[email protected]> Co-authored-by: kfox1111 <[email protected]>
27 lines
1017 B
YAML
27 lines
1017 B
YAML
spire-server:
|
|
controllerManager:
|
|
identities:
|
|
clusterSPIFFEIDs:
|
|
default:
|
|
enabled: false
|
|
keycloak:
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: default
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: keycloak
|
|
dnsNameTemplates:
|
|
- keycloak
|
|
keycloak-config-cli:
|
|
spiffeIDTemplate: spiffe://{{ .TrustDomain }}/ns/{{ .PodMeta.Namespace }}/sa/{{ .PodSpec.ServiceAccountName }}
|
|
namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: default
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/instance: keycloak-config-cli
|
|
dnsNameTemplates:
|
|
- keycloak-config-cli # This is the common name used for the certificate. In this case, the username
|