jakman85andClaude Opus 4.8
ed6a772599
Generate the 3 OIDC client secrets (SOPS-encrypted, minimal manifests) so the realm import can inject the grafana + oauth2-proxy client secrets and both consumers match: - platform/keycloak/keycloak-realm-clients.sops.yaml (grafana + oauth2-proxy client secrets) - platform/oauth2-proxy/oauth2-proxy-credentials.sops.yaml (client-id/secret/cookie) - platform/monitoring/grafana-oidc-credentials.sops.yaml (grafana client secret) Wire each into its component kustomization and re-enable oauth2-proxy in platform + platform-config (reverses the temp deferral now that its secret exists). Values generated by PM per operator instruction (random; recorded out-of-repo at ~/.config/home-k3s/keycloak-sso-secrets.txt for later rotation). Encrypted via sops in the dev container to the age recipient in .sops.yaml; plaintext never committed. Serves: R-IDP-01, R-IDP-02, R-IDP-04, R-SEC-01. Co-Authored-By: Claude Opus 4.8 <[email protected]>
33 lines
2.2 KiB
YAML
33 lines
2.2 KiB
YAML
---
|
|
# Keycloak CONTROLLERS half (F-MON1 split): the official Keycloak Operator (quay.io images) + its
|
|
# CRDs + the SOPS-encrypted admin credential. The Keycloak/KeycloakRealmImport CUSTOM RESOURCES live
|
|
# in ../../platform-config (dependsOn platform) so the CRDs registered here exist first.
|
|
#
|
|
# IMAGE STRATEGY (DECISIONS-LOG F-KY1): the old stub used the Bitnami Keycloak chart + bundled Bitnami
|
|
# PostgreSQL; Bitnami's free Docker Hub images were purged -> ImagePullBackOff. Replaced with the
|
|
# official Keycloak Operator (quay.io/keycloak/keycloak-operator + quay.io/keycloak/keycloak) and
|
|
# CloudNativePG (ghcr.io) for the DB (platform/cnpg) — both registries unaffected by the purge, and
|
|
# the Operator gives declarative Keycloak/realm CRs (R-IDP-03) + CNPG gives DR backup hooks (R-IDP-05).
|
|
#
|
|
# The operator manifests are pinned upstream RELEASE files pulled as remote bases (the same pattern the
|
|
# kubevirt stub documents). Renovate maintains the version. Offline `kubectl kustomize` fetches them;
|
|
# Flux fetches them at reconcile.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
# Force the operator's namespaced resources (ServiceAccount/Role/RoleBinding/Service/Deployment, which
|
|
# ship without an explicit namespace) into `keycloak`. CRDs + ClusterRoles are cluster-scoped and pass
|
|
# through unchanged; the ClusterRoleBinding subject already targets namespace keycloak.
|
|
namespace: keycloak
|
|
resources:
|
|
- namespace.yaml
|
|
# --- Keycloak Operator v26.0.6 (pinned upstream release manifests) ---
|
|
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
|
|
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
|
|
- https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/26.0.6/kubernetes/kubernetes.yml
|
|
# --- Admin (break-glass) credential — SOPS-encrypted, referenced by name (ADR-0007, R-IDP-04) ---
|
|
- keycloak-admin-credentials.sops.yaml
|
|
# --- OIDC client secrets (grafana + oauth2-proxy) the realm import injects via placeholders ---
|
|
- keycloak-realm-clients.sops.yaml
|
|
# --- Grafana dashboard for Keycloak health (plain ConfigMap; R-OBS-03) ---
|
|
- grafana-dashboard.yaml
|