Skip to content

Commit d8648fd

Browse files
ElderMattElderMatt
ElderMatt
and
ElderMatt
authored
feat: added keycloak operator (#1625)
Co-authored-by: ElderMatt <“[email protected]”>
1 parent d2b9e49 commit d8648fd

15 files changed

+412
-8
lines changed

‎charts/apl-keycloak-operator/.helmignore

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/apl-keycloak-operator/Chart.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: v2
2+
name: apl-keycloak-operator
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 0.1.0
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.16.0"

‎charts/apl-keycloak-operator/templates/NOTES.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
The apl-keycloak-operator has been deployed.

‎charts/apl-keycloak-operator/templates/_helpers.tpl

+62
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "apl-keycloak-operator.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "apl-keycloak-operator.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "apl-keycloak-operator.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "apl-keycloak-operator.labels" -}}
37+
helm.sh/chart: {{ include "apl-keycloak-operator.chart" . }}
38+
{{ include "apl-keycloak-operator.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "apl-keycloak-operator.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "apl-keycloak-operator.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "apl-keycloak-operator.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "apl-keycloak-operator.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/apl-keycloak-operator/templates/deployment.yaml

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "apl-keycloak-operator.fullname" . }}
5+
labels:
6+
{{- include "apl-keycloak-operator.labels" . | nindent 4 }}
7+
spec:
8+
replicas: {{ .Values.replicaCount }}
9+
selector:
10+
matchLabels:
11+
{{- include "apl-keycloak-operator.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "apl-keycloak-operator.labels" . | nindent 8 }}
20+
spec:
21+
{{- with .Values.imagePullSecrets }}
22+
imagePullSecrets:
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
serviceAccountName: {{ include "apl-keycloak-operator.serviceAccountName" . }}
26+
securityContext:
27+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
28+
containers:
29+
- name: {{ .Chart.Name }}
30+
securityContext:
31+
{{- toYaml .Values.securityContext | nindent 12 }}
32+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
33+
imagePullPolicy: {{ .Values.image.pullPolicy }}
34+
{{- if and .Values.configs (not (empty .Values.configs.tls.certificates)) }}
35+
command: ['/bin/sh', '-c']
36+
args: ['export NODE_EXTRA_CA_CERTS=/app/config/tls/certificate.crt && npm run operator:keycloak']
37+
env:
38+
- name: NODE_EXTRA_CA_CERTS
39+
value: "/app/config/tls/certificate.crt"
40+
{{- else }}
41+
command: ['npm', 'run', 'operator:keycloak']
42+
{{- end }}
43+
resources:
44+
{{- toYaml .Values.resources | nindent 12 }}
45+
volumeMounts:
46+
- name: tls-certs
47+
mountPath: /app/config/tls/certificate.crt
48+
subPath: certificate.crt
49+
{{- with .Values.nodeSelector }}
50+
nodeSelector:
51+
{{- toYaml . | nindent 8 }}
52+
{{- end }}
53+
{{- with .Values.affinity }}
54+
affinity:
55+
{{- toYaml . | nindent 8 }}
56+
{{- end }}
57+
{{- with .Values.tolerations }}
58+
tolerations:
59+
{{- toYaml . | nindent 8 }}
60+
{{- end }}
61+
volumes:
62+
- name: tls-certs
63+
secret:
64+
secretName: keycloak-operator-tls-certs-cm
65+
- name: operator-config-kc
66+
configMap:
67+
name: apl-keycloak-operator-cm
68+
- name: operator-secret-kc
69+
secret:
70+
secretName: apl-keycloak-operator-secret

‎charts/apl-keycloak-operator/templates/rbac.yaml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
{{- if .Values.serviceAccount.create }}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "apl-keycloak-operator.serviceAccountName" . }}
6+
namespace: {{ .Release.Namespace | quote }}
7+
automountServiceAccountToken: true
8+
---
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
kind: ClusterRole
11+
metadata:
12+
name: {{ include "apl-keycloak-operator.fullname" . }}-edit-keycloak
13+
rules:
14+
# Allows the operator to read pod information. This is necessary for monitoring pod statuses and gathering logs for debugging.
15+
- apiGroups: [""]
16+
resources: ["pods"]
17+
verbs: ["get", "watch", "list"]
18+
# Enables the operator to manage ConfigMaps. This is essential for reading configuration data that the operator might need to function correctly.
19+
- apiGroups: [""]
20+
resources: ["configmaps"]
21+
verbs: ["get", "watch", "list"]
22+
# Grants access to secrets. This is crucial for the operator to access sensitive information such as credentials, which might be stored in secrets.
23+
- apiGroups: [""]
24+
resources: ["secrets"]
25+
verbs: ["get", "watch", "list"]
26+
---
27+
apiVersion: rbac.authorization.k8s.io/v1
28+
kind: ClusterRoleBinding
29+
metadata:
30+
name: {{ include "apl-keycloak-operator.fullname" . }}-edit-keycloak
31+
namespace: "apl-keycloak-operator"
32+
subjects:
33+
- kind: ServiceAccount
34+
namespace: {{ .Release.Namespace }}
35+
name: {{ include "apl-keycloak-operator.fullname" . }}
36+
roleRef:
37+
kind: ClusterRole
38+
name: {{ include "apl-keycloak-operator.fullname" . }}-edit-keycloak
39+
apiGroup: rbac.authorization.k8s.io
40+
{{- end }}

‎charts/apl-keycloak-operator/templates/secrets.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{{- with .Values.configs.tls.certificates.caCert }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: keycloak-operator-tls-certs-cm
6+
namespace: apl-keycloak-operator
7+
data:
8+
certificate.crt: {{- . | b64enc | nindent 4 }}
9+
{{- end }}

‎charts/apl-keycloak-operator/values.yaml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Default values for apl-keycloak-operator.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
replicaCount: 1
6+
7+
image:
8+
repository: otomi/tasks
9+
pullPolicy: IfNotPresent
10+
# Overrides the image tag whose default is the chart appVersion.
11+
tag: main
12+
13+
imagePullSecrets: []
14+
nameOverride: ""
15+
fullnameOverride: ""
16+
17+
serviceAccount:
18+
# Specifies whether a service account should be created
19+
create: true
20+
name: "apl-keycloak-operator"
21+
annotations: {}
22+
23+
podAnnotations: {}
24+
25+
podSecurityContext:
26+
runAsNonRoot: true
27+
runAsUser: 1001
28+
runAsGroup: 1001
29+
fsGroup: 2000
30+
31+
securityContext:
32+
capabilities:
33+
drop:
34+
- ALL
35+
readOnlyRootFilesystem: true
36+
runAsNonRoot: true
37+
runAsUser: 1001
38+
39+
configs:
40+
tls:
41+
certificates: {}
42+
43+
resources: {}
44+
# We usually recommend not to specify default resources and to leave this as a conscious
45+
# choice for the user. This also increases chances charts run on environments with little
46+
# resources, such as Minikube. If you do want to specify resources, uncomment the following
47+
# lines, adjust them as necessary, and remove the curly braces after 'resources:'.
48+
# limits:
49+
# cpu: 100m
50+
# memory: 128Mi
51+
# requests:
52+
# cpu: 100m
53+
# memory: 128Mi
54+
55+
nodeSelector: {}
56+
57+
tolerations: []
58+
59+
affinity: {}

‎helmfile.d/helmfile-03.init.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,18 @@ releases:
2222
labels:
2323
pkg: otomi-operator
2424
<<: *default
25+
- name: apl-keycloak-operator
26+
installed: true
27+
namespace: apl-keycloak-operator
28+
labels:
29+
pkg: apl-keycloak-operator
30+
<<: *default
31+
- name: apl-keycloak-operator-artifacts
32+
installed: true
33+
namespace: apl-keycloak-operator
34+
labels:
35+
pkg: apl-keycloak-operator
36+
<<: *raw
2537
- name: gitea-artifacts
2638
installed: {{ $a | get "gitea.enabled" }}
2739
namespace: gitea

‎helmfile.d/helmfile-20.ingress.yaml

-7
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,3 @@ releases:
1616
installed: {{ $a | get "external-dns.enabled" }}
1717
namespace: external-dns
1818
<<: *default
19-
- name: job-keycloak
20-
installed: true
21-
labels:
22-
pkg: keycloak
23-
group: jobs
24-
<<: *jobs
25-

‎helmfile.d/snippets/defaults.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -457,6 +457,15 @@ environments:
457457
limits:
458458
cpu: 200m
459459
memory: 256Mi
460+
apl-keycloak-operator:
461+
resources:
462+
operator:
463+
requests:
464+
cpu: 100m
465+
memory: 128Mi
466+
limits:
467+
cpu: 200m
468+
memory: 256Mi
460469
promtail:
461470
enabled: false
462471
prometheus-blackbox-exporter: {}

‎src/cmd/apply.ts

-1
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,6 @@ const apply = async (): Promise<void> => {
141141
await applyAll()
142142
} catch (e) {
143143
d.error(e)
144-
await nothrow($`helm uninstall job-keycloak -n maintenance`)
145144
await nothrow($`helm uninstall wait-for-otomi-realm -n maintenance`)
146145
await nothrow($`kubectl delete job wait-for-otomi-realm -n maintenance`)
147146
d.info(`Retrying in ${retryOptions.maxRetryTime} ms`)

‎values-schema.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -2538,6 +2538,16 @@ properties:
25382538
properties:
25392539
operator:
25402540
$ref: '#/definitions/resources'
2541+
apl-keycloak-operator:
2542+
additionalProperties: false
2543+
properties:
2544+
_rawValues:
2545+
$ref: '#/definitions/rawValues'
2546+
resources:
2547+
additionalProperties: false
2548+
properties:
2549+
operator:
2550+
$ref: '#/definitions/resources'
25412551

25422552
oltp:
25432553
additionalProperties: false

0 commit comments

Comments
 (0)