Skip to content

Commit c931961

Browse files
jhoblittjhoblitt
committed
(ruka) add keycloak
1 parent f6541df commit c931961

18 files changed

+324
-0
lines changed

‎fleet/lib/keycloak-pg/cluster-keycloak-pg.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
apiVersion: postgresql.cnpg.io/v1
3+
kind: Cluster
4+
metadata:
5+
name: keycloak-pg
6+
spec:
7+
imageName: ghcr.io/cloudnative-pg/postgresql:15
8+
9+
instances: 3
10+
11+
bootstrap:
12+
initdb:
13+
database: keycloak
14+
owner: keycloak
15+
secret:
16+
name: keycloak-pg
17+
18+
postgresql:
19+
parameters:
20+
max_connections: "500"
21+
shared_buffers: 256MB
22+
idle_session_timeout: 4h
23+
pg_hba:
24+
- host replication postgres all md5
25+
- host all all 139.229.134.0/23 md5
26+
- host all all 139.229.136.0/21 md5
27+
- host all all 139.229.144.0/20 md5
28+
- host all all 139.229.160.0/19 md5
29+
- host all all 139.229.192.0/18 md5
30+
- host all all 140.252.146.0/23 md5
31+
32+
enableSuperuserAccess: true
33+
superuserSecret:
34+
name: keycloak-pg-superuser
35+
36+
storage:
37+
size: 1Gi
38+
39+
monitoring:
40+
enablePodMonitor: true
41+
42+
resources:
43+
limits:
44+
cpu: "1"
45+
memory: 1Gi
46+
requests:
47+
cpu: 500m
48+
memory: 1Gi

‎fleet/lib/keycloak-pg/cronjob-keycloak-pg-backup.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
apiVersion: batch/v1
3+
kind: CronJob
4+
metadata:
5+
name: keycloak-pg-backup
6+
spec:
7+
concurrencyPolicy: Forbid
8+
schedule: "0 12,21 * * *" #9AM CLT - 6PM CLT
9+
jobTemplate:
10+
spec:
11+
ttlSecondsAfterFinished: 172800
12+
template:
13+
spec:
14+
activeDeadlineSeconds: 3600
15+
containers:
16+
- name: cnpg-backup
17+
image: docker.io/lsstit/cnpg-backup:0.5
18+
volumeMounts:
19+
- name: ephemeral
20+
mountPath: /tmp
21+
imagePullPolicy: IfNotPresent
22+
envFrom:
23+
- secretRef:
24+
name: keycloak-pg-backup
25+
env:
26+
- name: HOST
27+
value: cnpg-loadbalancer.cloudnativepg.svc.cluster.local
28+
volumes:
29+
- name: ephemeral
30+
ephemeral:
31+
volumeClaimTemplate:
32+
spec:
33+
accessModes: [ReadWriteOnce]
34+
resources:
35+
requests:
36+
storage: 5Gi
37+
restartPolicy: OnFailure

‎fleet/lib/keycloak-pg/externalsecret-keycloak-pg.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-pg
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
template:
12+
type: kubernetes.io/basic-auth
13+
data:
14+
- secretKey: username
15+
remoteRef:
16+
key: &item keycloak-pg
17+
property: username
18+
- secretKey: password
19+
remoteRef:
20+
key: *item
21+
property: password

‎fleet/lib/keycloak-pg/fleet.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
defaultNamespace: &name keycloak-pg
3+
namespaceLabels:
4+
lsst.io/discover: "true"
5+
labels:
6+
bundle: *name
7+
helm:
8+
releaseName: *name
9+
waitForJobs: true
10+
dependsOn:
11+
- selector:
12+
matchLabels:
13+
bundle: cnpg-system
14+
targetCustomizations:
15+
- name: ruka
16+
clusterName: ruka
17+
yaml:
18+
overlays:
19+
- ruka

‎fleet/lib/keycloak-pg/overlays/ruka/externalsecret-keycloak-pg-backup.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-pg-backup
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
data:
11+
- secretKey: AWS_ACCESS_KEY_ID
12+
remoteRef:
13+
key: cnpg-aws-creds-ruka
14+
property: username
15+
- secretKey: AWS_SECRET_ACCESS_KEY
16+
remoteRef:
17+
key: cnpg-aws-creds-ruka
18+
property: password
19+
- secretKey: AWS_ACCESS_BUCKET
20+
remoteRef:
21+
key: cnpg-aws-creds-ruka
22+
property: website

‎fleet/lib/keycloak-pg/overlays/ruka/externalsecret-keycloak-pg-superuser.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-pg-superuser
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
target:
11+
template:
12+
type: kubernetes.io/basic-auth
13+
data:
14+
- secretKey: username
15+
remoteRef:
16+
key: cnpg-cluster-superuser-ruka
17+
property: username
18+
- secretKey: password
19+
remoteRef:
20+
key: cnpg-cluster-superuser-ruka
21+
property: password

‎fleet/lib/keycloak-pg/overlays/ruka/service-keycloak-pg.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: keycloak-pg
6+
labels:
7+
cnpg.io/cluster: keycloak-pg
8+
annotations:
9+
metallb.universe.tf/loadBalancerIPs: 139.229.134.152
10+
spec:
11+
ports:
12+
- name: postgres
13+
port: 5432
14+
protocol: TCP
15+
selector:
16+
cnpg.io/cluster: keycloak-pg
17+
role: primary
18+
type: LoadBalancer

‎fleet/lib/keycloak-pre/externalsecret-keycloak-admin.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-admin
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
data:
11+
- secretKey: username
12+
remoteRef:
13+
key: &item keycloak-admin
14+
property: username
15+
- secretKey: password
16+
remoteRef:
17+
key: *item
18+
property: password

‎fleet/lib/keycloak-pre/externalsecret-keycloak-pg.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
apiVersion: external-secrets.io/v1beta1
3+
kind: ExternalSecret
4+
metadata:
5+
name: keycloak-pg
6+
spec:
7+
secretStoreRef:
8+
kind: ClusterSecretStore
9+
name: onepassword
10+
data:
11+
- secretKey: username
12+
remoteRef:
13+
key: &item keycloak-pg
14+
property: username
15+
- secretKey: password
16+
remoteRef:
17+
key: *item
18+
property: password

‎fleet/lib/keycloak-pre/fleet.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
defaultNamespace: keycloak
3+
labels:
4+
bundle: &name keycloak-pre
5+
namespaceLabels:
6+
lsst.io/discover: "true"
7+
helm:
8+
releaseName: *name
9+
waitForJobs: true

0 commit comments

Comments
 (0)