bbadmin/keycloak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nelm-ready: public images overlays, nodeSelector fix, secrets

Browse Source
This commit is contained in:
ci 2026-09-11 14:28:17 +03:00
parent a41f3f4b9b
commit 74bf46f77b
10 changed files with 74 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.helm/Chart.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: v2
name: keycloak
description: Keycloak for nelm deploy
type: application
version: 1.0.0
appVersion: "26.4.0"

12
.helm/secret-values.yaml
View File

@ -1,10 +1,10 @@
keycloak:
password:
_default: 100019d23b8362f17b51fa105aa4ee817cbfc3ba6cec2427468d48a589fb40552cb29b82799efe896d0de6b29b2917e2de08
preprod: 10008a37f9b07c5afb21b7c23fc6052eeb43160a56e5a99ea65192007807192915a377a86af2663c79dc0b5af903c325ac95
prod: 10001ecb181e403d22a0530052a87ce07b9080247298c22d79b0f00550801db552659e6cf308164118ea8d2867c8c34eb0c5
_default: 100070e1eb1db1b32a496d757d1bf5d71929f082598f218bf17daf2b1bfcd17ac384
preprod: 100074f7210a1491676cc3d62af1ccc4fd94d612d5d0c1bf9df86b2189563a34f452
prod: 1000de66772c8c896c419ff93ec62fafbc201a7b35335b0e3e6e85d7b601700db415
postgres:
password:
_default: 10000d6340d0de2c7776d4955d1811a5ff135213cb7e101a8ea27fe240b3869179c40e0e70161f27f9bd618139917a357dc1
preprod: 100094cf6a127f06aee854384e745d50cfb900da0976bc1c81350b1039bca7d0e28123332d502725d55f9ec685a8683c8c38
prod: 1000e251d400b1660bb9c386c3b055d6d36d70edfba30e0b194a8f6e7d7bc278b1847a371b500ed7e9f639e9632176ee3d98
_default: 1000ad5aba0b2a1f6116d3c474670654e635c9ab6e6e3d4528e4b92c303570f4a01b
preprod: 1000279ce2f0e26377bcb9126a581673890f538baba82072eaabab60edde5c2837a1
prod: 10002e50e7e299d103fc1c70a55ac7e9b196b64d009697df164b2b8ec417a5d6d7d7

6
.helm/templates/04-secret-envs.yaml
View File

@ -3,9 +3,7 @@ apiVersion: v1
kind: Secret
metadata:
name: {{ .Chart.Name }}-env
annotations:
"werf.io/sensitive": "true"
type: Opaque
stringData:
KC_BOOTSTRAP_ADMIN_PASSWORD: {{ dig .Values.werf.env .Values.keycloak.password._default .Values.keycloak.password | quote }}
KC_DB_PASSWORD: {{ dig .Values.werf.env .Values.postgres.password._default .Values.postgres.password | quote }}
KC_BOOTSTRAP_ADMIN_PASSWORD: {{ dig .Values.env .Values.keycloak.password._default .Values.keycloak.password | quote }}
KC_DB_PASSWORD: {{ dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }}

18
.helm/templates/05-cm-envs.yaml
View File

@ -4,21 +4,21 @@ kind: ConfigMap
metadata:
name: {{ .Chart.Name }}-env
data:
KC_ADMIN: "admin"
KC_METRICS_ENABLED: {{ dig .Values.werf.env .Values.keycloak.metrics._default .Values.keycloak.metrics | quote }}
KC_HEALTH_ENABLED: {{ dig .Values.werf.env .Values.keycloak.health._default .Values.keycloak.health | quote }}
KC_HOSTNAME: "https://{{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_BOOTSTRAP_ADMIN_USERNAME: "admin"
KC_METRICS_ENABLED: {{ dig .Values.env .Values.keycloak.metrics._default .Values.keycloak.metrics | quote }}
KC_HEALTH_ENABLED: {{ dig .Values.env .Values.keycloak.health._default .Values.keycloak.health | quote }}
KC_HOSTNAME: "https://{{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_PROXY_ADDRESS_FORWARDING: "true"
KC_PROXY: "edge"
KC_DB: "postgres"
KC_DB_URL_HOST: "postgres"
KC_DB_URL_PORT: {{ .Values.postgres.port | quote }}
KC_DB_URL_DATABASE: {{ dig .Values.werf.env .Values.postgres.database._default .Values.postgres.database | quote }}
KC_DB_USERNAME: {{ dig .Values.werf.env .Values.postgres.user._default .Values.postgres.user | quote }}
KC_DB_URL_DATABASE: {{ dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }}
KC_DB_USERNAME: {{ dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }}
KC_CACHE: "ispn"
KC_CACHE_STACK: "kubernetes"
KC_HTTP_ENABLED: "true"
KC_FRONTEND_URL: "https://{{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_FRONTEND_URL: "https://{{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_PROXY_HEADERS: xforwarded
KEPTSTORE_URL: {{ dig .Values.werf.env .Values.keycloak.appUrl._default .Values.keycloak.appUrl | quote }}
KC_LOG_LEVEL: {{ dig .Values.werf.env .Values.keycloak.logLevel._default .Values.keycloak.logLevel | quote }}
KEPTSTORE_URL: {{ dig .Values.env .Values.keycloak.appUrl._default .Values.keycloak.appUrl | quote }}
KC_LOG_LEVEL: {{ dig .Values.env .Values.keycloak.logLevel._default .Values.keycloak.logLevel | quote }}

29
.helm/templates/10-postgres.yaml
View File

@ -1,18 +1,15 @@
{{- $pgDb := dig .Values.werf.env .Values.postgres.database._default .Values.postgres.database | quote }}
{{- $pgUser := dig .Values.werf.env .Values.postgres.user._default .Values.postgres.user | quote }}
{{- $pgPassword := dig .Values.werf.env .Values.postgres.password._default .Values.postgres.password | quote }}
{{- $pgStorageSize := dig .Values.werf.env .Values.postgres.storage.size._default .Values.postgres.storage.size | quote }}
{{- $pgStorageClass := dig .Values.werf.env .Values.postgres.storage.class._default .Values.postgres.storage.class | quote }}
{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
{{- $pgDb := dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }}
{{- $pgUser := dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }}
{{- $pgPassword := dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }}
{{- $pgStorageSize := dig .Values.env .Values.postgres.storage.size._default .Values.postgres.storage.size | quote }}
{{- $pgStorageClass := dig .Values.env .Values.postgres.storage.class._default .Values.postgres.storage.class | quote }}
{{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
{{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
---
apiVersion: v1
kind: Secret
metadata:
name: {{ .Chart.Name }}-postgres-env
annotations:
"werf.io/sensitive": "true"
werf.io/weight: "-31"
stringData:
POSTGRES_DB: {{ $pgDb }}
POSTGRES_USER: {{ $pgUser }}
@ -24,8 +21,6 @@ metadata:
name: {{ .Chart.Name }}-postgres
labels:
app: {{ .Chart.Name }}-postgres
annotations:
werf.io/weight: "-30"
spec:
serviceName: postgres
replicas: 1
@ -43,13 +38,15 @@ spec:
{{- if $tolerations }}
tolerations: {{ toYaml $tolerations | nindent 6 }}
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
- name: registrysecret
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: master
image: {{ .Values.werf.image.postgresql }}
image: {{ .Values.image.postgresql }}
imagePullPolicy: IfNotPresent
resources: {{ dig .Values.werf.env .Values.postgres.resources._default .Values.postgres.resources | toYaml | nindent 10 }}
resources: {{ dig .Values.env .Values.postgres.resources._default .Values.postgres.resources | toYaml | nindent 10 }}
volumeMounts:
- name: data
mountPath: /var/lib/postgresql/data
@ -106,8 +103,6 @@ apiVersion: v1
kind: ConfigMap
metadata:
name: {{ .Chart.Name }}-postgres
annotations:
werf.io/weight: "-31"
data:
postgresql.conf.sample: |
listen_addresses = '*'

16
.helm/templates/20-keycloak.yaml
View File

@ -1,5 +1,5 @@
{{- $nodeSelector := dig .Values.werf.env .Values.keycloak.nodeSelector._default .Values.keycloak.nodeSelector }}
{{- $tolerations := dig .Values.werf.env .Values.keycloak.tolerations._default .Values.keycloak.tolerations }}
{{- $nodeSelector := dig .Values.env .Values.keycloak.nodeSelector._default .Values.keycloak.nodeSelector }}
{{- $tolerations := dig .Values.env .Values.keycloak.tolerations._default .Values.keycloak.tolerations }}
---
apiVersion: apps/v1
kind: StatefulSet
@ -8,7 +8,7 @@ metadata:
labels:
app: {{ .Chart.Name }}
spec:
replicas: {{ dig .Values.werf.env .Values.keycloak.replicaCount._default .Values.keycloak.replicaCount }}
replicas: {{ dig .Values.env .Values.keycloak.replicaCount._default .Values.keycloak.replicaCount }}
serviceName: {{ .Chart.Name }}
selector:
matchLabels:
@ -39,12 +39,14 @@ spec:
- {{ .Chart.Name }}
topologyKey: kubernetes.io/hostname
weight: 100
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
- name: registrysecret
{{- toYaml . | nindent 8 }}
{{- end }}
containers:
- name: keycloak
image: {{ .Values.werf.image.keycloak }}
command: [ "/bin/bash","-c","/opt/keycloak/bin/kc.sh start -Djgroups.dns.query={{ .Chart.Name }}-headless.{{ .Values.werf.namespace }}.svc.cluster.local --legacy-observability-interface=true"]
image: {{ .Values.image.keycloak }}
command: [ "/bin/bash","-c","/opt/keycloak/bin/kc.sh start -Djgroups.dns.query={{ .Chart.Name }}-headless.{{ .Release.Namespace }}.svc.cluster.local --legacy-observability-interface=true"]
envFrom:
- secretRef:
name: {{ .Chart.Name }}-env
@ -63,7 +65,7 @@ spec:
failureThreshold: 15
periodSeconds: 3
timeoutSeconds: 3
resources: {{ dig .Values.werf.env .Values.keycloak.resources._default .Values.keycloak.resources | toYaml | nindent 10 }}
resources: {{ dig .Values.env .Values.keycloak.resources._default .Values.keycloak.resources | toYaml | nindent 10 }}
securityContext:
allowPrivilegeEscalation: false
runAsUser: 0

4
.helm/templates/90-ingress.yaml
View File

@ -11,9 +11,9 @@ metadata:
nginx.ingress.kubernetes.io/session-cookie-name: keycloak-cookie
nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
spec:
ingressClassName: {{ dig .Values.werf.env .Values.keycloak.ingress.classNames._default .Values.keycloak.ingress.classNames | quote }}
ingressClassName: {{ dig .Values.env .Values.keycloak.ingress.classNames._default .Values.keycloak.ingress.classNames | quote }}
rules:
- host: {{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain | quote }}
- host: {{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain | quote }}
http:
paths:
- backend:

4
.helm/values-public.yaml Normal file
View File

@ -0,0 +1,4 @@
image:
keycloak: quay.io/keycloak/keycloak:26.4.0
postgresql: docker.io/library/postgres:16-alpine
imagePullSecrets: []

36
.helm/values.yaml
View File

@ -1,26 +1,35 @@
global:
cluster: ""
env: dev
imagePullSecrets:
- name: registrysecret
image:
keycloak: 192.168.10.68:5000/keycloak/keycloak:26.4.0
postgresql: 192.168.10.68:5000/library/postgres:16-alpine
keycloak:
health:
_default: true
metrics:
_default: true
appUrl:
_default: https://app.pro.lukoil.com
preprod: https://app.preprod.pro.lukoil.com
prod: https://app.prod.pro.lukoil.com
_default: https://app.valdemorte.online
preprod: https://app.preprod.valdemorte.online
prod: https://app.prod.valdemorte.online
logLevel:
_default: INFO
preprod: INFO
prod: INFO
replicaCount:
_default: 1
nodeSelector:
_default:
node-role.deckhouse.io/worker: ""
node-role.kubernetes.io/worker: ""
tolerations:
_default: []
resources:
_default:
limits:
@ -40,12 +49,11 @@ keycloak:
requests:
cpu: 250m
memory: 1024Mi
ingress:
domain:
_default: keycloak.pro.lukoil.com
preprod: keycloak.preprod.pro.lukoil.com
prod: keycloak.prod.pro.lukoil.com
_default: keycloak.valdemorte.online
preprod: keycloak.preprod.valdemorte.online
prod: keycloak.prod.valdemorte.online
classNames:
_default: nginx
@ -61,8 +69,7 @@ postgres:
preprod: 10Gi
prod: 20Gi
class:
_default: local-storage-class-worker
_default: localpath
resources:
_default:
requests:
@ -70,9 +77,8 @@ postgres:
memory: 1Gi
limits:
memory: 2Gi
nodeSelector:
_default:
node-role.deckhouse.io/worker: ""
node-role.kubernetes.io/worker: ""
tolerations:
_default: []

3
Dockerfile Normal file
View File

@ -0,0 +1,3 @@
FROM quay.io/keycloak/keycloak:26.4.0
COPY plugins/ /opt/keycloak/providers/
USER 1000