Skip to content

Commit 90db22f

Browse files
filippomcfilippomc
authored
Merge pull request #800 from MetaCell/feature/ch-158
CH-159 Keycloak upgrade configuration changes
2 parents a7d4354 + f1461ae commit 90db22f

24 files changed

Lines changed: 148 additions & 51 deletions

File tree

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
*.jar
2+
# Allow the KC kafka plugin
3+
!applications/accounts/plugins/*.jar
24
.idea
35
node_modules
46
.openapi-generator

‎applications/accounts/Dockerfile‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
1-
FROM quay.io/keycloak/keycloak:16.1.0
1+
FROM quay.io/keycloak/keycloak:26.2.1
22

3-
# add kubectl
3+
EXPOSE 9000
4+
EXPOSE 8080
45
USER root
5-
COPY --chmod=0755 scripts/create_api_user.sh /opt/jboss/startup-scripts/create_api_user.sh
6-
USER jboss
6+
COPY --chmod=0755 scripts/create_api_user.sh /opt/keycloak/startup-scripts/create_api_user.sh
7+
COPY --chmod=0755 scripts/kc-entrypoint.sh /opt/keycloak/bin/kc-entrypoint.sh
8+
9+
USER keycloak
710

811
# Customize keycloak look
9-
COPY themes/custom /opt/jboss/keycloak/themes/custom
12+
COPY themes/custom /opt/keycloak/themes/custom
13+
14+
# # keycloak kafka listener plugin
15+
COPY plugins/metacell-admin-event-listener-module-1.0.0.jar /opt/keycloak/providers/
1016

11-
# keycloak kafka listener plugin
12-
COPY plugins/metacell-admin-event-listener-bundle-1.0.0.ear /opt/jboss/keycloak/standalone/deployments/
17+
ENTRYPOINT [ "/opt/keycloak/bin/kc-entrypoint.sh" ]
18+
CMD [ "start-dev", "--import-realm", "--health-enabled=true" ]

‎applications/accounts/admin-event-listener/jar-module/pom.xml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,28 @@
4949
<version>2.5.0</version>
5050
</dependency>
5151
</dependencies>
52+
53+
<build>
54+
<plugins>
55+
<plugin>
56+
<groupId>org.apache.maven.plugins</groupId>
57+
<artifactId>maven-shade-plugin</artifactId>
58+
<version>3.4.1</version>
59+
<executions>
60+
<execution>
61+
<phase>package</phase>
62+
<goals>
63+
<goal>shade</goal>
64+
</goals>
65+
<configuration>
66+
<createDependencyReducedPom>false</createDependencyReducedPom>
67+
<transformers>
68+
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
69+
</transformers>
70+
</configuration>
71+
</execution>
72+
</executions>
73+
</plugin>
74+
</plugins>
75+
</build>
5276
</project>

‎applications/accounts/deploy/values.yaml‎

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,23 +16,21 @@ harness:
1616
auto: true
1717
port: 8080
1818
env:
19-
- name: KEYCLOAK_IMPORT
20-
value: "/tmp/realm.json"
21-
- name: KEYCLOAK_USER
19+
- name: KC_BOOTSTRAP_ADMIN_USERNAME
2220
value: "admin"
23-
- name: KEYCLOAK_PASSWORD
21+
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
2422
value: "metacell"
25-
- name: PROXY_ADDRESS_FORWARDING
26-
value: "true"
27-
- name: DB_VENDOR
28-
value: "POSTGRES"
29-
- name: DB_ADDR
23+
- name: KC_PROXY_HEADERS
24+
value: xforwarded
25+
- name: KC_DB
26+
value: "postgres"
27+
- name: KC_DB_URL_HOST
3028
value: "keycloak-postgres"
31-
- name: DB_DATABASE
29+
- name: KC_DB_URL_DATABASE
3230
value: "auth_db"
33-
- name: DB_USER
31+
- name: KC_DB_USERNAME
3432
value: "user"
35-
- name: DB_PASSWORD
33+
- name: KC_DB_PASSWORD
3634
value: "password"
3735
- name: JAVA_OPTS
3836
value: -server -Xms64m -Xmx896m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true --add-exports=java.base/sun.nio.ch=ALL-UNNAMED --add-exports=jdk.unsupported/sun.misc=ALL-UNNAMED --add-exports=jdk.unsupported/sun.reflect=ALL-UNNAMED
@@ -42,7 +40,7 @@ harness:
4240
type: postgres
4341
size: 2Gi
4442
postgres:
45-
image: postgres:10.4
43+
image: postgres:17
4644
initialdb: auth_db
4745
user: user
4846
pass: password
@@ -51,9 +49,16 @@ harness:
5149
resources:
5250
- name: realm-config
5351
src: realm.json
54-
dst: /tmp/realm.json
52+
dst: /opt/keycloak/data/import/realm.json
53+
startupProbe:
54+
path: /health/started
55+
port: 9000
5556
readinessProbe:
56-
path: /auth/realms/master
57+
path: /health/ready
58+
port: 9000
59+
livenessProbe:
60+
path: /health/live
61+
port: 9000
5762

5863
# Keycloak realm configuration
5964
client:

applications/accounts/plugins/metacell-admin-event-listener-bundle-1.0.0.ear renamed to applications/accounts/plugins/metacell-admin-event-listener-module-1.0.0.jar

9.51 MB
Binary file not shown.

‎applications/accounts/scripts/create_api_user.sh‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,6 @@ set -e
88
echo Creating API user
99

1010
# create the user and reload keycloak
11-
/opt/jboss/keycloak/bin/add-user-keycloak.sh -u ${USERNAME} -p ${PASSWORD}
11+
/opt/keycloak/bin/kcadm.sh create users -s "username=$USERNAME" -s enabled=True
12+
/opt/keycloak/bin/kcadm.sh set-password --username "$USERNAME" --new-password "$PASSWORD"
13+
/opt/keycloak/bin/kcadm.sh add-roles --uusername "$USERNAME" --rolename admin

‎applications/accounts/scripts/kc-entrypoint.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#! /bin/bash
2+
3+
/opt/keycloak/bin/kc.sh $@ &
4+
5+
until /opt/keycloak/bin/kcadm.sh config credentials \
6+
--server http://localhost:8080 \
7+
--realm master \
8+
--user "$KC_BOOTSTRAP_ADMIN_USERNAME" \
9+
--password "$KC_BOOTSTRAP_ADMIN_PASSWORD";
10+
do
11+
sleep 1s
12+
done
13+
14+
for script in /opt/keycloak/startup-scripts/*.sh;
15+
do
16+
bash "$script";
17+
done
18+
19+
wait

‎applications/jupyterhub/deploy/resources/hub/jupyterhub_config.py‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -546,13 +546,16 @@ def camelCaseify(s):
546546
c.OAuthenticator.client_secret = client_secret
547547
c.OAuthenticator.allow_all = True
548548

549+
549550
c.GenericOAuthenticator.login_service = "CH"
550551
c.GenericOAuthenticator.username_key = "email"
551-
c.GenericOAuthenticator.authorize_url = f"{accounts_url}/auth/realms/{realm}/protocol/openid-connect/auth"
552-
c.GenericOAuthenticator.token_url = f"{accounts_url}/auth/realms/{realm}/protocol/openid-connect/token"
553-
c.GenericOAuthenticator.userdata_url = f"{accounts_url}/auth/realms/{realm}/protocol/openid-connect/userinfo"
552+
c.GenericOAuthenticator.username_claim = "email"
553+
c.GenericOAuthenticator.scope = ["openid"]
554+
c.GenericOAuthenticator.authorize_url = f"{accounts_url}/realms/{realm}/protocol/openid-connect/auth"
555+
c.GenericOAuthenticator.token_url = f"{accounts_url}/realms/{realm}/protocol/openid-connect/token"
556+
c.GenericOAuthenticator.userdata_url = f"{accounts_url}/realms/{realm}/protocol/openid-connect/userinfo"
554557
c.GenericOAuthenticator.userdata_params = {'state': 'state'}
555-
558+
c.GenericOAuthenticator.admin_groups = {"administrator"}
556559

557560
set_config_if_not_none(c.OAuthenticator, 'scope', 'auth.scopes')
558561

‎applications/jupyterhub/src/harness_jupyter/harness_jupyter/jupyterhub.py‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,14 @@
1818
def custom_options_form(spawner, abc):
1919
# let's skip the profile selection form for now
2020
# ToDo: for future we can remove this hook
21-
spawner._ch_profile_list = spawner.profile_list
22-
spawner.profile_list = []
2321
# ref: https://github.com/jupyterhub/kubespawner/blob/37a80abb0a6c826e5c118a068fa1cf2725738038/kubespawner/spawner.py#L1885-L1935
22+
try:
23+
print("Cloudharness: start saving profile list in _ch_profile_list")
24+
spawner._ch_profile_list = spawner.profile_list
25+
spawner.profile_list = []
26+
print("Cloudharness: saving profile list in _ch_profile_list")
27+
except Exception as e:
28+
print(f"Cloudharness: finish daving profile exception: {e}")
2429
return spawner._options_form_default()
2530

2631

@@ -32,9 +37,8 @@ def harness_hub():
3237
"""Wraps the method to change spawner configuration"""
3338
KubeSpawner.get_pod_manifest_base = KubeSpawner.get_pod_manifest
3439
KubeSpawner.get_pod_manifest = spawner_pod_manifest
35-
# let's skip the profile selection form for now
36-
# TODO: for future we can remove this hook
37-
KubeSpawner.options_form = custom_options_form
40+
# to skip the profile selection form enable the line below
41+
# KubeSpawner.options_form = custom_options_form
3842
KubeSpawner.get_pvc_manifest_base = KubeSpawner.get_pvc_manifest
3943
KubeSpawner.get_pvc_manifest = spawner_pvc_manifest
4044

‎deployment-configuration/compose/templates/auto-compose.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ services:
8686
{{- end }}
8787
{{- if eq $app_name "accounts" }}
8888
healthcheck:
89-
test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/auth/realms/{{ $.Values.namespace }}/account"]
89+
test: ["CMD", "curl", "-f", "http://127.0.0.1:8080/realms/{{ $.Values.namespace }}/account"]
9090
interval: 1s
9191
timeout: 3s
9292
retries: 30

0 commit comments

Comments
 (0)