Skip to content

Commit 60a58d6

Browse files
skestwalskestwal
committed
feat(RHIDP-9113): Update Keycloak configuration for Red Hat Build of Keycloak (RHBK):
- Remove /auth prefix from KEYCLOAK_BASE_URL endpoints - Update OIDC issuer URLs: /auth/realms/ → /realms/ - Add PostgreSQL database configuration to Keycloak CR - Configure bootstrap admin credentials and proxy headers
1 parent 8054a6d commit 60a58d6

File tree

8 files changed

+34
-17
lines changed

8 files changed

+34
-17
lines changed

‎ci-scripts/rhdh-setup/create_resource.sh‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ get_group_path_by_name() {
195195
local group_name="$input"
196196
token=$(get_token)
197197

198-
response=$(curl -s -k --location --request GET "$(keycloak_url)/auth/admin/realms/backstage/groups?search=${group_name}" \
198+
response=$(curl -s -k --location --request GET "$(keycloak_url)/admin/realms/backstage/groups?search=${group_name}" \
199199
-H 'Content-Type: application/json' \
200200
-H "Authorization: Bearer $token" 2>&1)
201201

@@ -221,7 +221,7 @@ get_group_id_by_name() {
221221
group_name="$1"
222222
token=$(get_token)
223223

224-
response=$(curl -s -k --location --request GET "$(keycloak_url)/auth/admin/realms/backstage/groups?search=${group_name}" \
224+
response=$(curl -s -k --location --request GET "$(keycloak_url)/admin/realms/backstage/groups?search=${group_name}" \
225225
-H 'Content-Type: application/json' \
226226
-H "Authorization: Bearer $token" 2>&1)
227227

@@ -269,7 +269,7 @@ assign_parent_group() {
269269
attempt=1
270270
while (( attempt <= max_attempts )); do
271271
token=$(get_token)
272-
response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups/${parent_id}/children" \
272+
response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups/${parent_id}/children" \
273273
-H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
274274
--data-raw '{"name":"'"${child_name}"'"}' 2>&1)"
275275
if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -296,7 +296,7 @@ create_group() {
296296
groupname="g${idx}"
297297
while ((attempt <= max_attempts)); do
298298
token=$(get_token)
299-
response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups" \
299+
response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups" \
300300
-H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
301301
--data-raw '{"name":"'"${groupname}"'"}' 2>&1)"
302302
if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -319,7 +319,7 @@ create_group() {
319319
groupname="g${idx}"
320320
while ((attempt <= max_attempts)); do
321321
token=$(get_token)
322-
response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/groups" \
322+
response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/groups" \
323323
-H 'Content-Type: application/json' -H "Authorization: Bearer $token" \
324324
--data-raw '{"name":"'"${groupname}"'"}' 2>&1)"
325325
if [ "${PIPESTATUS[0]}" -eq 0 ] && ! echo "$response" | grep -q 'error' >&/dev/null; then
@@ -444,7 +444,7 @@ create_user() {
444444
while ((attempt <= max_attempts)); do
445445
token=$(get_token)
446446
username="t${0}"
447-
response="$(curl -s -k --location --request POST "$(keycloak_url)/auth/admin/realms/backstage/users" \
447+
response="$(curl -s -k --location --request POST "$(keycloak_url)/admin/realms/backstage/users" \
448448
-H 'Content-Type: application/json' \
449449
-H 'Authorization: Bearer '"$token" \
450450
--data-raw '{"firstName":"'"${username}"'","lastName":"tester", "email":"'"${username}"'@test.com","emailVerified":"true", "enabled":"true", "username":"'"${username}"'","groups":'"$groups"',"credentials":[{"type":"password","value":"'"${KEYCLOAK_USER_PASS}"'","temporary":false}]}' 2>&1)"
@@ -499,7 +499,7 @@ log_token_err() {
499499
}
500500

501501
keycloak_token() {
502-
curl -s -k "$(keycloak_url)/auth/realms/master/protocol/openid-connect/token" -d username=admin -d "password=$1" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
502+
curl -s -k "$(keycloak_url)/realms/master/protocol/openid-connect/token" -d username=admin -d "password=$1" -d 'grant_type=password' -d 'client_id=admin-cli' | jq -r ".expires_in_timestamp = $(python3 -c 'from datetime import datetime, timedelta; t_add=int(30); print(int((datetime.now() + timedelta(seconds=t_add)).timestamp()))')"
503503
}
504504

505505
rhdh_token() {
@@ -526,7 +526,7 @@ rhdh_token() {
526526
--data-urlencode "redirect_uri=${REDIRECT_URL}" \
527527
--data-urlencode "scope=openid email profile" \
528528
--data-urlencode "response_type=code" \
529-
"$(keycloak_url)/auth/realms/$REALM/protocol/openid-connect/auth" 2>&1| tee "$TMP_DIR/auth_url.log" | grep -oE 'action="[^"]+"' | grep -oE '"[^"]+"' | tr -d '"')
529+
"$(keycloak_url)/realms/$REALM/protocol/openid-connect/auth" 2>&1| tee "$TMP_DIR/auth_url.log" | grep -oE 'action="[^"]+"' | grep -oE '"[^"]+"' | tr -d '"')
530530

531531
execution=$(echo "$AUTH_URL" | grep -oE 'execution=[^&]+' | grep -oE '[^=]+$')
532532
tab_id=$(echo "$AUTH_URL" | grep -oE 'tab_id=[^&]+' | grep -oE '[^=]+$')

‎ci-scripts/rhdh-setup/deploy.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,10 @@ keycloak_install() {
251251
envsubst <template/keycloak/keycloak.yaml | $clin apply -f -
252252
wait_to_start statefulset rhdh-keycloak 450 600
253253

254+
$clin create secret generic credential-rhdh-keycloak \
255+
--from-literal=ADMIN_PASSWORD=admin \
256+
--dry-run=client -o yaml | $clin apply -f -
257+
254258
$clin create route edge keycloak \
255259
--service=rhdh-keycloak-service \
256260
--port=8080 \

‎ci-scripts/rhdh-setup/template/backstage/helm/chart-values.image-override.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ upstream:
5757
key: github.token
5858
name: "{{ .Release.Name }}-plugin-secrets"
5959
- name: KEYCLOAK_BASE_URL
60-
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
60+
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
6161
- name: KEYCLOAK_LOGIN_REALM
6262
value: "backstage"
6363
- name: KEYCLOAK_REALM

‎ci-scripts/rhdh-setup/template/backstage/helm/chart-values.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ upstream:
5757
key: github.token
5858
name: "{{ .Release.Name }}-plugin-secrets"
5959
- name: KEYCLOAK_BASE_URL
60-
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
60+
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
6161
- name: KEYCLOAK_LOGIN_REALM
6262
value: "backstage"
6363
- name: KEYCLOAK_REALM

‎ci-scripts/rhdh-setup/template/backstage/helm/oauth2-container-patch.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ extraContainers:
1818
key: keycloak_cookie_secret
1919
name: perf-test-secrets
2020
- name: OAUTH2_PROXY_OIDC_ISSUER_URL
21-
value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth/realms/backstage
21+
value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/realms/backstage
2222
- name: OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY
2323
value: "true"
2424
- name: OAUTH2_PROXY_LOGGING_LEVEL

‎ci-scripts/rhdh-setup/template/backstage/olm/backstage.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ spec:
1818
extraEnvs:
1919
envs:
2020
- name: KEYCLOAK_BASE_URL
21-
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth"
21+
value: "https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}"
2222
- name: KEYCLOAK_LOGIN_REALM
2323
value: "backstage"
2424
- name: KEYCLOAK_REALM

‎ci-scripts/rhdh-setup/template/backstage/olm/rhdh-oauth2.deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ spec:
4040
key: keycloak_cookie_secret
4141
name: perf-test-secrets
4242
- name: OAUTH2_PROXY_OIDC_ISSUER_URL
43-
value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/auth/realms/backstage
43+
value: https://keycloak-${RHDH_NAMESPACE}.${OPENSHIFT_APP_DOMAIN}/realms/backstage
4444
- name: OAUTH2_PROXY_SSL_INSECURE_SKIP_VERIFY
4545
value: "true"
4646
image: quay.io/oauth2-proxy/oauth2-proxy:v7.12.0

‎ci-scripts/rhdh-setup/template/keycloak/keycloak.yaml‎

Lines changed: 17 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,27 @@ metadata:
66
app: keycloak
77
spec:
88
instances: ${RHDH_KEYCLOAK_REPLICAS}
9+
db:
10+
vendor: postgres
11+
host: keycloak-postgresql
12+
port: 5432
13+
database: keycloak
14+
usernameSecret:
15+
name: keycloak-db-user
16+
key: keycloak-db-user
17+
passwordSecret:
18+
name: keycloak-postgresql
19+
key: password
920
hostname:
1021
strict: false
1122
http:
1223
httpEnabled: true
1324
ingress:
1425
enabled: true
1526
additionalOptions:
16-
- name: hostname-strict
17-
value: "false"
18-
- name: http-enabled
19-
value: "true"
27+
- name: bootstrap-admin-username
28+
value: admin
29+
- name: bootstrap-admin-password
30+
value: admin
31+
- name: proxy-headers
32+
value: forwarded

0 commit comments

Comments
 (0)