Skip to content

Commit 920e3c4

Browse files
minmzzhangminmzzhang
committed
feat: Externalize ZTVP charts: rhbk
Signed-off-by: Min Zhang <minzhang@redhat.com>
1 parent d93375f commit 920e3c4

20 files changed

Lines changed: 821 additions & 14 deletions

‎.github/linters/.checkov.yaml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,15 @@ directory:
55
skip-path:
66
- tests
77
skip-check:
8-
- CKV_K8S_49 # Minimize wildcard use in Roles and ClusterRoles
9-
- CKV_K8S_155 # Minimize ClusterRoles that grant control over validating or mutating admission webhook configurations
10-
- CKV_K8S_156 # Minimize ClusterRoles that grant permissions to approve CertificateSigningRequests
11-
- CKV_K8S_157 # Minimize Roles and ClusterRoles that grant permissions to bind RoleBindings or ClusterRoleBindings
12-
- CKV_K8S_158 # Minimize Roles and ClusterRoles that grant permissions to escalate Roles or ClusterRoles
8+
# CKV_K8S_49: Minimize wildcard use in Roles and ClusterRoles
9+
- CKV_K8S_49
10+
# CKV_K8S_155: ClusterRoles for admission webhook configurations
11+
- CKV_K8S_155
12+
# CKV_K8S_156: ClusterRoles to approve CertificateSigningRequests
13+
- CKV_K8S_156
14+
# CKV_K8S_157: Roles/ClusterRoles to bind RoleBindings or ClusterRoleBindings
15+
- CKV_K8S_157
16+
# CKV_K8S_158: Roles/ClusterRoles to escalate Roles or ClusterRoles
17+
- CKV_K8S_158
18+
# CKV_SECRET_6: Placeholders and External Secrets refs only; no real base64 secrets in repo
19+
- CKV_SECRET_6

‎.github/workflows/superlinter.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,6 @@ jobs:
1414
with:
1515
sl_env: |
1616
VALIDATE_BIOME_FORMAT=false
17+
# Exclude Helm templates ({{ }} not valid YAML for yamllint/kubeconform)
18+
FILTER_REGEX_EXCLUDE=.*/templates/.*
19+
VALIDATE_GITHUB_ACTIONS_ZIZMOR=false

‎.trivyignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# AVD-KSV-0011: PostgreSQL StatefulSet; resources.limits.cpu from values
2+
AVD-KSV-0011
3+
# AVD-KSV-0014: PostgreSQL StatefulSet; readOnlyRootFilesystem not set (DB needs writable data dir)
4+
AVD-KSV-0014
5+
# AVD-KSV-0015: PostgreSQL StatefulSet; resources.requests.cpu from values
6+
AVD-KSV-0015
7+
# AVD-KSV-0016: PostgreSQL StatefulSet; resources.requests.memory from values
8+
AVD-KSV-0016
9+
# AVD-KSV-0018: PostgreSQL StatefulSet; resources.limits.memory from values
10+
AVD-KSV-0018
11+
# AVD-KSV-0020: PostgreSQL StatefulSet; runAsUser from values or OpenShift namespace default
12+
AVD-KSV-0020
13+
# AVD-KSV-0021: PostgreSQL StatefulSet; runAsGroup from values or OpenShift namespace default
14+
AVD-KSV-0021
15+
# AVD-KSV-0125: PostgreSQL image from chart/default registry; trusted in deployment
16+
AVD-KSV-0125

‎.yamllint‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
extends: default
2+
ignore:
3+
- templates/
4+
- "**/templates/**"
5+
rules:
6+
document-start: disable
7+
line-length:
8+
max: 120
9+
brackets:
10+
min-spaces-inside: 0
11+
max-spaces-inside: 1

‎Chart.yaml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
description: Deploys RHBK
33
keywords:
44
- pattern
5-
name: vp-template
6-
version: 0.0.1
5+
name: rh-keycloak
6+
type: application
7+
version: 0.0.2
8+
home: https://github.com/validatedpatterns/rhbk-chart
9+
maintainers:
10+
- name: Validated Patterns Team
11+
email: validatedpatterns@googlegroups.com

‎Makefile‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,10 @@ test: helm-lint helm-unittest ## Runs helm lint and unit tests
3636
.PHONY: super-linter
3737
super-linter: ## Runs super linter locally
3838
rm -rf .mypy_cache
39-
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40-
-e VALIDATE_BIOME_FORMAT=false \
41-
-v $(PWD):/tmp/lint:rw,z \
42-
-w /tmp/lint \
43-
ghcr.io/super-linter/super-linter:slim-v8
39+
podman run -e RUN_LOCAL=true -e USE_FIND_ALGORITHM=true \
40+
-e VALIDATE_BIOME_FORMAT=false \
41+
-e "FILTER_REGEX_EXCLUDE=.*/templates/.*" \
42+
-e VALIDATE_GITHUB_ACTIONS_ZIZMOR=false \
43+
-v $(PWD):/tmp/lint:rw,z \
44+
-w /tmp/lint \
45+
ghcr.io/super-linter/super-linter:slim-v8

‎templates/.keep‎

Whitespace-only changes.

‎templates/_helpers.tpl‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{{/*
2+
Generate the name of the Service.
3+
*/}}
4+
{{- define "keycloak.service.name" -}}
5+
{{- if eq .Values.keycloak.tls.serviceServing true }}
6+
{{- printf "%s-service-serving" .Values.keycloak.name }}
7+
{{- else }}
8+
{{- printf "%s-service" .Values.keycloak.name }}
9+
{{- end }}
10+
{{- end }}
11+
12+
{{/*
13+
Generate the hostname for the Ingress.
14+
*/}}
15+
16+
{{- define "keycloak.ingress.hostname" -}}
17+
{{- if or (not .Values.keycloak.ingress.hostname) (eq .Values.keycloak.ingress.hostname "") }}
18+
{{- printf "%s.%s" .Values.keycloak.name .Values.global.localClusterDomain }}
19+
{{- else }}
20+
{{- print .Values.keycloak.ingress.hostname }}
21+
{{- end }}
22+
{{- end }}

‎templates/keycloak-admin-user-external-secret.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{{- if eq .Values.keycloak.adminUser.enabled true }}
2+
apiVersion: "external-secrets.io/v1beta1"
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-admin-user
6+
namespace: {{ .Release.Namespace }}
7+
spec:
8+
refreshInterval: 15s
9+
secretStoreRef:
10+
name: {{ .Values.global.secretStore.name }}
11+
kind: {{ .Values.global.secretStore.kind }}
12+
target:
13+
name: {{ .Values.keycloak.adminUser.secretName }}
14+
template:
15+
type: Opaque
16+
data:
17+
username: "{{ .Values.keycloak.adminUser.username }}"
18+
password: "{{ `{{ .admin_password }}` }}"
19+
data:
20+
- secretKey: admin_password
21+
remoteRef:
22+
key: {{ .Values.keycloak.adminUser.passwordVaultKey }}
23+
property: admin-password
24+
{{- end }}

‎templates/keycloak-ingress.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if eq .Values.keycloak.ingress.enabled true }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
annotations:
6+
route.openshift.io/termination: {{ .Values.keycloak.ingress.termination }}
7+
route.openshift.io/destination-ca-certificate-secret: {{ .Values.keycloak.tls.secret | quote }}
8+
labels:
9+
app: {{ .Values.keycloak.name }}
10+
app.kubernetes.io/instance: {{ .Values.keycloak.name }}
11+
name: {{ .Values.keycloak.name }}-ingress
12+
namespace: {{ .Release.Namespace }}
13+
spec:
14+
defaultBackend:
15+
service:
16+
name: {{ include "keycloak.service.name" . }}
17+
port:
18+
number: 8443
19+
rules:
20+
- host: {{ include "keycloak.ingress.hostname" . }}
21+
http:
22+
paths:
23+
- backend:
24+
service:
25+
name: {{ include "keycloak.service.name" . }}
26+
port:
27+
number: 8443
28+
pathType: ImplementationSpecific
29+
{{- end }}

0 commit comments

Comments
 (0)