chore: update keycloak template to be aligned with latest layered-zero-trust submissions.

- Qtodo using federated JWT (SPIFFE) instead of a client secret when oidcSecrets.qtodo.enabled is false.
- ACS Central having its own OIDC client and admin user, with secrets coming from Vault and the new ExternalSecrets.

Signed-off-by: Min Zhang <minzhang@redhat.com>

Author: minmzzhang

templates/acs-oidc-client-secret-external-secret.yaml

@@ -0,0 +1,24 @@
+{{- if .Values.keycloak.defaultConfig }}
+---
+apiVersion: "external-secrets.io/v1beta1"
+kind: ExternalSecret
+metadata:
+  name: acs-oidc-client-secret
+  namespace: {{ .Release.Namespace }}
+spec:
+  refreshInterval: 15s
+  secretStoreRef:
+    name: {{ .Values.global.secretStore.name }}
+    kind: {{ .Values.global.secretStore.kind }}
+  target:
+    name: acs-oidc-client-secret
+    template:
+      type: Opaque
+      data:
+        client-secret: "{{ `{{ .client_secret }}` }}"
+  data:
+  - secretKey: client_secret
+    remoteRef:
+      key: {{ .Values.keycloak.oidcSecrets.acsClient.vaultPath }}
+      property: admin-password
+{{- end }}

templates/keycloak-realm-import.yaml

@@ -7,18 +7,50 @@ Merge realms
 {{- $realms = append $realms .Values.keycloak.defaultRealm }}
 {{- end }}
 {{- range $realms }}
+{{- $realm := deepCopy . }}
+{{- $localDomain := $.Values.global.localClusterDomain }}
+{{- $oidcProviderBase := printf "https://spire-spiffe-oidc-discovery-provider.%s" $localDomain }}
+{{- if $.Values.keycloak.spiffeIdentityProvider.enabled }}
+{{- $spiffeConfig := deepCopy $.Values.keycloak.spiffeIdentityProvider.config }}
+{{- $defaultJwksUrl := printf "%s/keys" $oidcProviderBase }}
+{{- if or (not (hasKey $spiffeConfig.config "issuer")) (eq (index $spiffeConfig.config "issuer") "") }}
+{{- $_ := set $spiffeConfig.config "issuer" $oidcProviderBase }}
+{{- end }}
+{{- if or (not (hasKey $spiffeConfig.config "jwksUrl")) (eq (index $spiffeConfig.config "jwksUrl") "") }}
+{{- $_ := set $spiffeConfig.config "jwksUrl" $defaultJwksUrl }}
+{{- end }}
+{{- if or (not (hasKey $spiffeConfig.config "authorizationUrl")) (eq (index $spiffeConfig.config "authorizationUrl") "") }}
+{{- $_ := set $spiffeConfig.config "authorizationUrl" (printf "%s/authorize" $oidcProviderBase) }}
+{{- end }}
+{{- if or (not (hasKey $spiffeConfig.config "tokenUrl")) (eq (index $spiffeConfig.config "tokenUrl") "") }}
+{{- $_ := set $spiffeConfig.config "tokenUrl" (printf "%s/token" $oidcProviderBase) }}
+{{- end }}
+{{- $existingIdps := default list $realm.identityProviders }}
+{{- $_ := set $realm "identityProviders" (append $existingIdps $spiffeConfig) }}
+{{- end }}
+{{/* Auto-populate jwt.credential.sub for federated-jwt clients */}}
+{{- range $realm.clients }}
+{{- if eq (default "" .clientAuthenticatorType) "federated-jwt" }}
+{{- $attrs := default dict .attributes }}
+{{- if or (not (hasKey $attrs "jwt.credential.sub")) (eq (index $attrs "jwt.credential.sub") "") }}
+{{- $clientName := default .clientId .name }}
+{{- $_ := set $attrs "jwt.credential.sub" (printf "spiffe://%s/ns/%s/sa/%s" $localDomain $clientName $clientName) }}
+{{- end }}
+{{- $_ := set . "attributes" $attrs }}
+{{- end }}
+{{- end }}
 ---
 apiVersion: k8s.keycloak.org/v2alpha1
 kind: KeycloakRealmImport
 metadata:
-  name: "{{ .realm }}-realm-import"
+  name: "{{ $realm.realm }}-realm-import"
   namespace: "{{ $.Release.Namespace }}"
   annotations:
     argocd.argoproj.io/sync-wave: "10"
 spec:
   keycloakCRName: keycloak
   realm:
-{{- toYaml . | nindent 4 }}
+{{- toYaml $realm | nindent 4 }}
   placeholders:
     QTODO_ADMIN_PASSWORD:
       secret:
@@ -36,13 +68,23 @@ spec:
       secret:
         name: {{ $.Values.keycloak.users.secretName }}
         key: rhtpa-user-password
+{{- if and $.Values.keycloak.oidcSecrets.qtodo (default false $.Values.keycloak.oidcSecrets.qtodo.enabled) }}
     QTODO_CLIENT_SECRET:
       secret:
         name: oidc-client-secret
         key: client-secret
+{{- end }}
     RHTPA_CLI_SECRET:
       secret:
         name: rhtpa-oidc-cli-secret
         key: client-secret
+    ACS_ADMIN_PASSWORD:
+      secret:
+        name: {{ $.Values.keycloak.users.secretName }}
+        key: acs-admin-password
+    ACS_CLIENT_SECRET:
+      secret:
+        name: acs-oidc-client-secret
+        key: client-secret
+{{- end }}
 {{- end }}
-{{- end }}

templates/keycloak-users-external-secret.yaml

@@ -18,6 +18,7 @@ spec:
         qtodo-user1-password: "{{ `{{ .qtodo_user1_password }}` }}"
         rhtas-user-password: "{{ `{{ .rhtas_user_password }}` }}"
         rhtpa-user-password: "{{ `{{ .rhtpa_user_password }}` }}"
+        acs-admin-password: "{{ `{{ .acs_admin_password }}` }}"
   data:
   - secretKey: qtodo_admin_password
     remoteRef:
@@ -35,4 +36,8 @@ spec:
     remoteRef:
       key: {{ .Values.keycloak.users.passwordVaultKey }}
       property: rhtpa-user-password
+  - secretKey: acs_admin_password
+    remoteRef:
+      key: secret/data/hub/infra/acs/acs-central
+      property: admin-password
 {{- end }}

templates/keycloak.yaml

@@ -6,6 +6,12 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-wave: "5"
 spec:
+{{- if .Values.keycloak.spiffeIdentityProvider.enabled }}
+  features:
+    enabled:
+      - spiffe
+      - client-auth-federated
+{{- end }}
 {{- if eq .Values.keycloak.adminUser.enabled true }}
   bootstrapAdmin:
     user:

templates/oidc-client-secret-external-secret.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.keycloak.defaultConfig }}
+{{- if and .Values.keycloak.defaultConfig (default false .Values.keycloak.oidcSecrets.qtodo.enabled) }}
 apiVersion: "external-secrets.io/v1beta1"
 kind: ExternalSecret
 metadata: