Keycloak setup

services/keycloak/keycloak-deployment.yaml

@@ -1,33 +1,35 @@
-apiVersion: k8s.keycloak.org/v2beta1
-kind: Keycloak
+apiVersion: apps/v1
+kind: Deployment
 metadata:
   name: keycloak
-  namespace: default
+  namespace: security
 spec:
-  instances: 1
-  image: quay.io/keycloak/keycloak:latest
-  startOptimized: false
-  db:
-    vendor: postgres
-    host: birdfeeder2.home.nest
-    port: 5432
-    database: keycloak
-    usernameSecret:
-      name: keycloak-db-secret
-      key: username
-    passwordSecret:
-      name: keycloak-db-secret
-      key: password
-  http:
-    httpEnabled: true
-  hostname:
-    hostname: sso.mynest.love
-    strict: true
-  bootstrapAdmin:
-    user:
-      secret: keycloak-admin-login
-  additionalOptions:
-    - name: proxy-headers
-      value: xforwarded
-  ingress:
-    enabled: false
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak
+  template:
+    metadata:
+      labels:
+        app: keycloak
+    spec:
+      containers:
+      - name: keycloak
+        image: quay.io/keycloak/keycloak:24.0.0
+        command: ["/bin/sh", "-c", "/opt/keycloak/bin/kc.sh start"]
+        envFrom:
+          - secretRef:
+              name: keycloak-credentials
+        env:
+        - name: KC_HOSTNAME
+          value: "sso.mynest.love"
+        - name: KC_PROXY_HEADERS
+          value: "xforwarded"
+        - name: KC_HTTP_ENABLED
+          value: "true"
+        - name: KC_TRANSACTION_XA_ENABLED
+          value: "false"
+        - name: KC_DB
+          value: "postgres"
+        - name: KC_DB_URL
+          value: "jdbc:postgresql://keycloak-postgres:5432/keycloak"

services/keycloak/keycloak-external-secrets.yaml

@@ -1,45 +1,57 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: keycloak-db-credentials
-  namespace: default
+  name: keycloak-postgres-credentials
+  namespace: security
 spec:
   refreshInterval: "1h"
   secretStoreRef:
     name: vault-external-secrets-store
     kind: ClusterSecretStore
   target:
-    name: keycloak-db-secret
+    name: keycloak-postgres-credentials
     creationPolicy: Owner
   data:
-  - secretKey: username
+  - secretKey: POSTGRES_USER
     remoteRef:
-      key: keycloak/database
-      property: username
-  - secretKey: password
+      key: keycloak
+      property: db-user
+  - secretKey: POSTGRES_PASSWORD
     remoteRef:
-      key: keycloak/database
-      property: password
+      key: keycloak
+      property: db-password
+  - secretKey: POSTGRES_DB
+    remoteRef:
+      key: keycloak
+      property: db-name
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: keycloak-admin-credentials
-  namespace: default
+  name: keycloak-credentials
+  namespace: security
 spec:
   refreshInterval: "1h"
   secretStoreRef:
     name: vault-external-secrets-store
     kind: ClusterSecretStore
   target:
-    name: keycloak-admin-login
+    name: keycloak-credentials
     creationPolicy: Owner
   data:
-  - secretKey: username
+  - secretKey: KC_DB_USERNAME
     remoteRef:
-      key: keycloak/admin
-      property: username
-  - secretKey: password
+      key: keycloak
+      property: db-user
+  - secretKey: KC_DB_PASSWORD
     remoteRef:
-      key: keycloak/admin
-      property: password
+      key: keycloak
+      property: db-password
+  - secretKey: KEYCLOAK_ADMIN
+    remoteRef:
+      key: keycloak
+      property: admin-user
+  - secretKey: KEYCLOAK_ADMIN_PASSWORD
+    remoteRef:
+      key: keycloak
+      property: admin-password

services/keycloak/keycloak-ingress.yaml

@@ -1,25 +1,12 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: keycloak-proxy-headers
-  namespace: default
-spec:
-  headers:
-    customRequestHeaders:
-      X-Forwarded-Proto: "https"
----
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: keycloak-ingress
-  namespace: default
+  namespace: security
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: default-keycloak-proxy-headers@kubernetescrd
 spec:
-  ingressClassName: traefik
   tls:
   - hosts:
     - sso.mynest.love
@@ -32,6 +19,6 @@ spec:
         pathType: Prefix
         backend:
           service:
-            name: keycloak-service
+            name: keycloak
             port:
               number: 8080

services/keycloak/keycloak-postgres.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keycloak-postgres
+  namespace: security
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: keycloak-postgres
+  template:
+    metadata:
+      labels:
+        app: keycloak-postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:15-alpine
+        envFrom:
+          - secretRef:
+              name: keycloak-postgres-credentials
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql/data
+          subPath: postgres-data
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: keycloak-db-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: keycloak-db-pvc
+  namespace: security
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/critical-data: "enabled"
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: "longhorn"
+  resources:
+    requests:
+      storage: 5Gi

services/keycloak/keycloak-realm.yaml

@@ -1,15 +0,0 @@
-apiVersion: k8s.keycloak.org/v2alpha1
-kind: KeycloakRealmImport
-metadata:
-  name: keycloak-realm
-  namespace: default
-spec:
-  keycloakCRName: keycloak
-  realm:
-    id: nest
-    realm: nest
-    enabled: true
-    displayName: "Nest SSO"
-    # You will eventually dump your full JSON realm export here
-    # clients: [...]
-    # users: [...]

services/keycloak/keycloak-service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak
+  namespace: security
+spec:
+  selector:
+    app: keycloak
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: keycloak-postgres
+  namespace: security
+spec:
+  selector:
+    app: keycloak-postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432