Moritz Schmitz von Hülstandkfox1111
43a72a22ff
* Add example for using Spire for mTLS with Keycloak Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Minor improvement to the README.md Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * But I still need to learn GitHub Markdown format Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Make it more obvious that it works without a (correct) password Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Add warning for Kubernetes 1.29+ feature Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move ghostunnel into an initContainer with restartPolicy=Always Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Apply suggestions from code review Co-authored-by: kfox1111 <[email protected]> Signed-off-by: Moritz Schmitz von Hülst <[email protected]> * Move java-spiffe-helper-properties into extraDeploy of the Keycloak chart and pin node version to it has a matching rancher/kubectl image Signed-off-by: Moritz Schmitz von Hülst <[email protected]> --------- Signed-off-by: Moritz Schmitz von Hülst <[email protected]> Co-authored-by: kfox1111 <[email protected]>
85 lines
2.5 KiB
YAML
85 lines
2.5 KiB
YAML
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: keycloak-config-cli
|
|
labels:
|
|
app: keycloak-config-cli
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: keycloak-config-cli
|
|
app.kubernetes.io/instance: keycloak-config-cli # This needs to match the podSelector for the SpiffeID
|
|
spec:
|
|
initContainers:
|
|
- name: ghostunnel
|
|
image: ghostunnel/ghostunnel:v1.7.3
|
|
imagePullPolicy: IfNotPresent
|
|
restartPolicy: Always
|
|
args:
|
|
- client
|
|
- --use-workload-api-addr
|
|
- unix:///run/spire/agent-sockets/spire-agent.sock # The filename depends on what the spire-agent uses
|
|
- --listen
|
|
- localhost:8080 # Listen on local http
|
|
- --target
|
|
- keycloak:8443 # Tunnel via https
|
|
- --status
|
|
- http://0.0.0.0:6060
|
|
ports:
|
|
- containerPort: 8080
|
|
name: listen
|
|
protocol: TCP
|
|
- containerPort: 6060
|
|
name: readiness
|
|
protocol: TCP
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /_status
|
|
port: readiness
|
|
volumeMounts:
|
|
- name: spire-sockets
|
|
mountPath: /run/spire/agent-sockets
|
|
readOnly: true
|
|
containers:
|
|
- name: keycloak-config-cli
|
|
image: adorsys/keycloak-config-cli:latest
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: KEYCLOAK_URL
|
|
value: "http://127.0.0.1:8080"
|
|
- name: KEYCLOAK_USER
|
|
value: "keycloak-config-cli"
|
|
- name: KEYCLOAK_PASSWORD
|
|
value: "doesn't matter, since we are authenticated via the client certificate"
|
|
- name: KEYCLOAK_CLIENTID
|
|
value: "keycloak-config-cli" # This is the client created on bootstrapping Keycloak via the keycloak-config-cli sidecar
|
|
volumeMounts:
|
|
- name: realm
|
|
mountPath: /config
|
|
restartPolicy: OnFailure
|
|
volumes:
|
|
- name: realm
|
|
configMap:
|
|
name: keycloak-config-cli
|
|
- name: spire-sockets
|
|
hostPath:
|
|
path: /run/spire/agent-sockets # This needs to match the path mounted by the spire-agent
|
|
type: DirectoryOrCreate
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: keycloak-config-cli
|
|
labels:
|
|
app: keycloak-config-cli
|
|
data:
|
|
keycloak-config-cli.json: |
|
|
{
|
|
"id": "keycloak-config-cli",
|
|
"realm": "keycloak-config-cli",
|
|
"enabled": true
|
|
}
|