bbadmin/keycloak
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nelm-ready: public images overlays, nodeSelector fix, secrets

Browse Source
This commit is contained in:
ci 2026-09-11 14:28:17 +03:00
parent a41f3f4b9b
commit 74bf46f77b
10 changed files with 74 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
.helm/Chart.yaml Normal file
View File

@ -0,0 +1,6 @@
apiVersion: v2
name: keycloak
description: Keycloak for nelm deploy
type: application
version: 1.0.0
appVersion: "26.4.0"

12
.helm/secret-values.yaml
View File

@ -1,10 +1,10 @@
keycloak: keycloak:
password: password:
_default: 100019d23b8362f17b51fa105aa4ee817cbfc3ba6cec2427468d48a589fb40552cb29b82799efe896d0de6b29b2917e2de08 _default: 100070e1eb1db1b32a496d757d1bf5d71929f082598f218bf17daf2b1bfcd17ac384
preprod: 10008a37f9b07c5afb21b7c23fc6052eeb43160a56e5a99ea65192007807192915a377a86af2663c79dc0b5af903c325ac95 preprod: 100074f7210a1491676cc3d62af1ccc4fd94d612d5d0c1bf9df86b2189563a34f452
prod: 10001ecb181e403d22a0530052a87ce07b9080247298c22d79b0f00550801db552659e6cf308164118ea8d2867c8c34eb0c5 prod: 1000de66772c8c896c419ff93ec62fafbc201a7b35335b0e3e6e85d7b601700db415
postgres: postgres:
password: password:
_default: 10000d6340d0de2c7776d4955d1811a5ff135213cb7e101a8ea27fe240b3869179c40e0e70161f27f9bd618139917a357dc1 _default: 1000ad5aba0b2a1f6116d3c474670654e635c9ab6e6e3d4528e4b92c303570f4a01b
preprod: 100094cf6a127f06aee854384e745d50cfb900da0976bc1c81350b1039bca7d0e28123332d502725d55f9ec685a8683c8c38 preprod: 1000279ce2f0e26377bcb9126a581673890f538baba82072eaabab60edde5c2837a1
prod: 1000e251d400b1660bb9c386c3b055d6d36d70edfba30e0b194a8f6e7d7bc278b1847a371b500ed7e9f639e9632176ee3d98 prod: 10002e50e7e299d103fc1c70a55ac7e9b196b64d009697df164b2b8ec417a5d6d7d7

6
.helm/templates/04-secret-envs.yaml
View File

@ -3,9 +3,7 @@ apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ .Chart.Name }}-env name: {{ .Chart.Name }}-env
annotations:
"werf.io/sensitive": "true"
type: Opaque type: Opaque
stringData: stringData:
KC_BOOTSTRAP_ADMIN_PASSWORD: {{ dig .Values.werf.env .Values.keycloak.password._default .Values.keycloak.password | quote }} KC_BOOTSTRAP_ADMIN_PASSWORD: {{ dig .Values.env .Values.keycloak.password._default .Values.keycloak.password | quote }}
KC_DB_PASSWORD: {{ dig .Values.werf.env .Values.postgres.password._default .Values.postgres.password | quote }} KC_DB_PASSWORD: {{ dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }}

18
.helm/templates/05-cm-envs.yaml
View File

@ -4,21 +4,21 @@ kind: ConfigMap
metadata: metadata:
name: {{ .Chart.Name }}-env name: {{ .Chart.Name }}-env
data: data:
KC_ADMIN: "admin" KC_BOOTSTRAP_ADMIN_USERNAME: "admin"
KC_METRICS_ENABLED: {{ dig .Values.werf.env .Values.keycloak.metrics._default .Values.keycloak.metrics | quote }} KC_METRICS_ENABLED: {{ dig .Values.env .Values.keycloak.metrics._default .Values.keycloak.metrics | quote }}
KC_HEALTH_ENABLED: {{ dig .Values.werf.env .Values.keycloak.health._default .Values.keycloak.health | quote }} KC_HEALTH_ENABLED: {{ dig .Values.env .Values.keycloak.health._default .Values.keycloak.health | quote }}
KC_HOSTNAME: "https://{{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}" KC_HOSTNAME: "https://{{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_PROXY_ADDRESS_FORWARDING: "true" KC_PROXY_ADDRESS_FORWARDING: "true"
KC_PROXY: "edge" KC_PROXY: "edge"
KC_DB: "postgres" KC_DB: "postgres"
KC_DB_URL_HOST: "postgres" KC_DB_URL_HOST: "postgres"
KC_DB_URL_PORT: {{ .Values.postgres.port | quote }} KC_DB_URL_PORT: {{ .Values.postgres.port | quote }}
KC_DB_URL_DATABASE: {{ dig .Values.werf.env .Values.postgres.database._default .Values.postgres.database | quote }} KC_DB_URL_DATABASE: {{ dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }}
KC_DB_USERNAME: {{ dig .Values.werf.env .Values.postgres.user._default .Values.postgres.user | quote }} KC_DB_USERNAME: {{ dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }}
KC_CACHE: "ispn" KC_CACHE: "ispn"
KC_CACHE_STACK: "kubernetes" KC_CACHE_STACK: "kubernetes"
KC_HTTP_ENABLED: "true" KC_HTTP_ENABLED: "true"
KC_FRONTEND_URL: "https://{{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}" KC_FRONTEND_URL: "https://{{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain }}"
KC_PROXY_HEADERS: xforwarded KC_PROXY_HEADERS: xforwarded
KEPTSTORE_URL: {{ dig .Values.werf.env .Values.keycloak.appUrl._default .Values.keycloak.appUrl | quote }} KEPTSTORE_URL: {{ dig .Values.env .Values.keycloak.appUrl._default .Values.keycloak.appUrl | quote }}
KC_LOG_LEVEL: {{ dig .Values.werf.env .Values.keycloak.logLevel._default .Values.keycloak.logLevel | quote }} KC_LOG_LEVEL: {{ dig .Values.env .Values.keycloak.logLevel._default .Values.keycloak.logLevel | quote }}

29
.helm/templates/10-postgres.yaml
View File

@ -1,18 +1,15 @@
{{- $pgDb := dig .Values.werf.env .Values.postgres.database._default .Values.postgres.database | quote }} {{- $pgDb := dig .Values.env .Values.postgres.database._default .Values.postgres.database | quote }}
{{- $pgUser := dig .Values.werf.env .Values.postgres.user._default .Values.postgres.user | quote }} {{- $pgUser := dig .Values.env .Values.postgres.user._default .Values.postgres.user | quote }}
{{- $pgPassword := dig .Values.werf.env .Values.postgres.password._default .Values.postgres.password | quote }} {{- $pgPassword := dig .Values.env .Values.postgres.password._default .Values.postgres.password | quote }}
{{- $pgStorageSize := dig .Values.werf.env .Values.postgres.storage.size._default .Values.postgres.storage.size | quote }} {{- $pgStorageSize := dig .Values.env .Values.postgres.storage.size._default .Values.postgres.storage.size | quote }}
{{- $pgStorageClass := dig .Values.werf.env .Values.postgres.storage.class._default .Values.postgres.storage.class | quote }} {{- $pgStorageClass := dig .Values.env .Values.postgres.storage.class._default .Values.postgres.storage.class | quote }}
{{- $nodeSelector := dig .Values.werf.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }} {{- $nodeSelector := dig .Values.env .Values.postgres.nodeSelector._default .Values.postgres.nodeSelector }}
{{- $tolerations := dig .Values.werf.env .Values.postgres.tolerations._default .Values.postgres.tolerations }} {{- $tolerations := dig .Values.env .Values.postgres.tolerations._default .Values.postgres.tolerations }}
--- ---
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
metadata: metadata:
name: {{ .Chart.Name }}-postgres-env name: {{ .Chart.Name }}-postgres-env
annotations:
"werf.io/sensitive": "true"
werf.io/weight: "-31"
stringData: stringData:
POSTGRES_DB: {{ $pgDb }} POSTGRES_DB: {{ $pgDb }}
POSTGRES_USER: {{ $pgUser }} POSTGRES_USER: {{ $pgUser }}
@ -24,8 +21,6 @@ metadata:
name: {{ .Chart.Name }}-postgres name: {{ .Chart.Name }}-postgres
labels: labels:
app: {{ .Chart.Name }}-postgres app: {{ .Chart.Name }}-postgres
annotations:
werf.io/weight: "-30"
spec: spec:
serviceName: postgres serviceName: postgres
replicas: 1 replicas: 1
@ -43,13 +38,15 @@ spec:
{{- if $tolerations }} {{- if $tolerations }}
tolerations: {{ toYaml $tolerations | nindent 6 }} tolerations: {{ toYaml $tolerations | nindent 6 }}
{{- end }} {{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets: imagePullSecrets:
- name: registrysecret {{- toYaml . | nindent 8 }}
{{- end }}
containers: containers:
- name: master - name: master
image: {{ .Values.werf.image.postgresql }} image: {{ .Values.image.postgresql }}
imagePullPolicy: IfNotPresent imagePullPolicy: IfNotPresent
resources: {{ dig .Values.werf.env .Values.postgres.resources._default .Values.postgres.resources | toYaml | nindent 10 }} resources: {{ dig .Values.env .Values.postgres.resources._default .Values.postgres.resources | toYaml | nindent 10 }}
volumeMounts: volumeMounts:
- name: data - name: data
mountPath: /var/lib/postgresql/data mountPath: /var/lib/postgresql/data
@ -106,8 +103,6 @@ apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: {{ .Chart.Name }}-postgres name: {{ .Chart.Name }}-postgres
annotations:
werf.io/weight: "-31"
data: data:
postgresql.conf.sample: | postgresql.conf.sample: |
listen_addresses = '*' listen_addresses = '*'

16
.helm/templates/20-keycloak.yaml
View File

@ -1,5 +1,5 @@
{{- $nodeSelector := dig .Values.werf.env .Values.keycloak.nodeSelector._default .Values.keycloak.nodeSelector }} {{- $nodeSelector := dig .Values.env .Values.keycloak.nodeSelector._default .Values.keycloak.nodeSelector }}
{{- $tolerations := dig .Values.werf.env .Values.keycloak.tolerations._default .Values.keycloak.tolerations }} {{- $tolerations := dig .Values.env .Values.keycloak.tolerations._default .Values.keycloak.tolerations }}
--- ---
apiVersion: apps/v1 apiVersion: apps/v1
kind: StatefulSet kind: StatefulSet
@ -8,7 +8,7 @@ metadata:
labels: labels:
app: {{ .Chart.Name }} app: {{ .Chart.Name }}
spec: spec:
replicas: {{ dig .Values.werf.env .Values.keycloak.replicaCount._default .Values.keycloak.replicaCount }} replicas: {{ dig .Values.env .Values.keycloak.replicaCount._default .Values.keycloak.replicaCount }}
serviceName: {{ .Chart.Name }} serviceName: {{ .Chart.Name }}
selector: selector:
matchLabels: matchLabels:
@ -39,12 +39,14 @@ spec:
- {{ .Chart.Name }} - {{ .Chart.Name }}
topologyKey: kubernetes.io/hostname topologyKey: kubernetes.io/hostname
weight: 100 weight: 100
{{- with .Values.imagePullSecrets }}
imagePullSecrets: imagePullSecrets:
- name: registrysecret {{- toYaml . | nindent 8 }}
{{- end }}
containers: containers:
- name: keycloak - name: keycloak
image: {{ .Values.werf.image.keycloak }} image: {{ .Values.image.keycloak }}
command: [ "/bin/bash","-c","/opt/keycloak/bin/kc.sh start -Djgroups.dns.query={{ .Chart.Name }}-headless.{{ .Values.werf.namespace }}.svc.cluster.local --legacy-observability-interface=true"] command: [ "/bin/bash","-c","/opt/keycloak/bin/kc.sh start -Djgroups.dns.query={{ .Chart.Name }}-headless.{{ .Release.Namespace }}.svc.cluster.local --legacy-observability-interface=true"]
envFrom: envFrom:
- secretRef: - secretRef:
name: {{ .Chart.Name }}-env name: {{ .Chart.Name }}-env
@ -63,7 +65,7 @@ spec:
failureThreshold: 15 failureThreshold: 15
periodSeconds: 3 periodSeconds: 3
timeoutSeconds: 3 timeoutSeconds: 3
resources: {{ dig .Values.werf.env .Values.keycloak.resources._default .Values.keycloak.resources | toYaml | nindent 10 }} resources: {{ dig .Values.env .Values.keycloak.resources._default .Values.keycloak.resources | toYaml | nindent 10 }}
securityContext: securityContext:
allowPrivilegeEscalation: false allowPrivilegeEscalation: false
runAsUser: 0 runAsUser: 0

4
.helm/templates/90-ingress.yaml
View File

@ -11,9 +11,9 @@ metadata:
nginx.ingress.kubernetes.io/session-cookie-name: keycloak-cookie nginx.ingress.kubernetes.io/session-cookie-name: keycloak-cookie
nginx.ingress.kubernetes.io/use-forwarded-headers: "true" nginx.ingress.kubernetes.io/use-forwarded-headers: "true"
spec: spec:
ingressClassName: {{ dig .Values.werf.env .Values.keycloak.ingress.classNames._default .Values.keycloak.ingress.classNames | quote }} ingressClassName: {{ dig .Values.env .Values.keycloak.ingress.classNames._default .Values.keycloak.ingress.classNames | quote }}
rules: rules:
- host: {{ dig .Values.werf.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain | quote }} - host: {{ dig .Values.env .Values.keycloak.ingress.domain._default .Values.keycloak.ingress.domain | quote }}
http: http:
paths: paths:
- backend: - backend:

4
.helm/values-public.yaml Normal file
View File

@ -0,0 +1,4 @@
image:
keycloak: quay.io/keycloak/keycloak:26.4.0
postgresql: docker.io/library/postgres:16-alpine
imagePullSecrets: []

36
.helm/values.yaml
View File

@ -1,26 +1,35 @@
global:
cluster: ""
env: dev
imagePullSecrets:
- name: registrysecret
image:
keycloak: 192.168.10.68:5000/keycloak/keycloak:26.4.0
postgresql: 192.168.10.68:5000/library/postgres:16-alpine
keycloak: keycloak:
health: health:
_default: true _default: true
metrics: metrics:
_default: true _default: true
appUrl: appUrl:
_default: https://app.pro.lukoil.com _default: https://app.valdemorte.online
preprod: https://app.preprod.pro.lukoil.com preprod: https://app.preprod.valdemorte.online
prod: https://app.prod.pro.lukoil.com prod: https://app.prod.valdemorte.online
logLevel: logLevel:
_default: INFO _default: INFO
preprod: INFO preprod: INFO
prod: INFO prod: INFO
replicaCount: replicaCount:
_default: 1 _default: 1
nodeSelector: nodeSelector:
_default: _default:
node-role.deckhouse.io/worker: "" node-role.kubernetes.io/worker: ""
tolerations: tolerations:
_default: [] _default: []
resources: resources:
_default: _default:
limits: limits:
@ -40,12 +49,11 @@ keycloak:
requests: requests:
cpu: 250m cpu: 250m
memory: 1024Mi memory: 1024Mi
ingress: ingress:
domain: domain:
_default: keycloak.pro.lukoil.com _default: keycloak.valdemorte.online
preprod: keycloak.preprod.pro.lukoil.com preprod: keycloak.preprod.valdemorte.online
prod: keycloak.prod.pro.lukoil.com prod: keycloak.prod.valdemorte.online
classNames: classNames:
_default: nginx _default: nginx
@ -61,8 +69,7 @@ postgres:
preprod: 10Gi preprod: 10Gi
prod: 20Gi prod: 20Gi
class: class:
_default: local-storage-class-worker _default: localpath
resources: resources:
_default: _default:
requests: requests:
@ -70,9 +77,8 @@ postgres:
memory: 1Gi memory: 1Gi
limits: limits:
memory: 2Gi memory: 2Gi
nodeSelector: nodeSelector:
_default: _default:
node-role.deckhouse.io/worker: "" node-role.kubernetes.io/worker: ""
tolerations: tolerations:
_default: [] _default: []

3
Dockerfile Normal file
View File

@ -0,0 +1,3 @@
FROM quay.io/keycloak/keycloak:26.4.0
COPY plugins/ /opt/keycloak/providers/
USER 1000