WIP keycloak stack (gate probe)

2026-08-24 19:52:25 -05:00
1 parent 254d50a20c
commit ce83c6af3b
@@ -0,0 +1,75 @@
+---
+# Keycloak instance (CR of the Operator CRD installed by platform/keycloak). CARRIED BY
+# platform-config (dependsOn platform) — F-MON1 controllers/configs split.
+#
+# Served behind the shared Gateway at keycloak.home.keithjackson.dev (public, hardened): TLS is
+# terminated by the Gateway wildcard cert, so Keycloak runs HTTP internally + trusts X-Forwarded-*
+# (production/proxy-aware, docs/15). Admin (break-glass) credential comes from the SOPS-encrypted
+# keycloak-admin-credentials Secret; realm/clients/groups are reconciled by the KeycloakRealmImport.
+apiVersion: k8s.keycloak.org/v2alpha1
+kind: Keycloak
+metadata:
+  name: keycloak
+  namespace: keycloak
+spec:
+  instances: ${KEYCLOAK_REPLICAS}          # overlay knob (dev 1 / prod 2 HA) — R-ENV-02
+  # --- Database: CloudNativePG cluster (platform/keycloak/postgres-cluster.yaml). The read-write
+  #     service keycloak-db-rw + the CNPG-generated keycloak-db-app secret (keys username/password). ---
+  db:
+    vendor: postgres
+    host: keycloak-db-rw
+    port: 5432
+    database: keycloak
+    usernameSecret:
+      name: keycloak-db-app
+      key: username
+    passwordSecret:
+      name: keycloak-db-app
+      key: password
+    poolMinSize: 5
+    poolMaxSize: 20
+  # --- Exposure: TLS at the Gateway; Keycloak serves HTTP and trusts the proxy headers. ---
+  hostname:
+    hostname: https://keycloak.home.keithjackson.dev
+  http:
+    httpEnabled: true                      # TLS is terminated at the Gateway (edge), not in Keycloak
+  proxy:
+    headers: xforwarded                    # trust X-Forwarded-* from the shared Gateway
+  ingress:
+    enabled: false                         # exposed via Gateway API HTTPRoute (httproute.yaml), not the
+                                           # operator's built-in Ingress
+  # --- Hardening + observability options (docs/15). Brute-force detection is a REALM setting
+  #     (bruteForceProtected in the realm import); these enable health + metrics endpoints. ---
+  additionalOptions:
+    - name: metrics-enabled
+      value: "true"
+    - name: health-enabled
+      value: "true"
+  resources:
+    requests:
+      cpu: 250m
+      memory: 768Mi
+    limits:
+      memory: 1280Mi
+  # --- Admin bootstrap credential (R-IDP-04, break-glass R-IDP-05) ---
+  # The provisioned SOPS secret keycloak-admin-credentials carries keys admin-user/admin-password.
+  # The operator's supported spec.bootstrapAdmin.user.secret expects keys username/password, so — to
+  # consume the already-provisioned secret WITHOUT re-keying it (must not touch its encrypted data) —
+  # the credential is injected via the podTemplate escape hatch as KC_BOOTSTRAP_ADMIN_* env, which
+  # Keycloak reads to create the temporary bootstrap/break-glass admin on first start.
+  unsupported:
+    podTemplate:
+      spec:
+        containers:
+          - name: keycloak
+            env:
+              - name: KC_BOOTSTRAP_ADMIN_USERNAME
+                valueFrom:
+                  secretKeyRef:
+                    name: keycloak-admin-credentials
+                    key: admin-user
+              - name: KC_BOOTSTRAP_ADMIN_PASSWORD
+                valueFrom:
+                  secretKeyRef:
+                    name: keycloak-admin-credentials
+                    key: admin-password