Skip to content

Commit b465368

Browse files
vincentchalamonvincentchalamon
committed
chore: replace bitnami/keycloak with custom template
1 parent bdff0bc commit b465368

File tree

12 files changed

+260
-66
lines changed

12 files changed

+260
-66
lines changed

‎compose.e2e.yaml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,10 @@
11
services:
22
keycloak:
3+
command: start-dev --import-realm
34
environment:
4-
KEYCLOAK_ENABLE_HTTPS: "true"
5-
KEYCLOAK_HTTPS_USE_PEM: "true"
6-
KEYCLOAK_HTTPS_CERTIFICATE_FILE: /opt/bitnami/keycloak/certs/tls.crt
7-
KEYCLOAK_HTTPS_CERTIFICATE_KEY_FILE: /opt/bitnami/keycloak/certs/tls.key
8-
KEYCLOAK_EXTRA_ARGS: "--import-realm"
5+
KC_HTTPS_CERTIFICATE_FILE: /opt/keycloak/certs/tls.crt
6+
KC_HTTPS_CERTIFICATE_KEY_FILE: /opt/keycloak/certs/tls.key
97
volumes:
10-
- ./helm/api-platform/keycloak/certs/tls.crt:/opt/bitnami/keycloak/certs/tls.crt:ro
11-
- ./helm/api-platform/keycloak/certs/tls.pem:/opt/bitnami/keycloak/certs/tls.key:ro
12-
- ./helm/api-platform/keycloak/config:/opt/bitnami/keycloak/data/import
8+
- ./helm/api-platform/keycloak/certs/tls.crt:/opt/keycloak/certs/tls.crt:ro
9+
- ./helm/api-platform/keycloak/certs/tls.pem:/opt/keycloak/certs/tls.key:ro
10+
- ./helm/api-platform/keycloak/config:/opt/keycloak/data/import

‎compose.override.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,7 @@ services:
5757
build:
5858
context: ./helm/api-platform/keycloak/
5959
target: keycloak
60-
environment:
61-
KEYCLOAK_EXTRA_ARGS: "--import-realm"
60+
command: start-dev --import-realm
6261
volumes:
63-
- ./helm/api-platform/keycloak/themes/api-platform-demo:/opt/bitnami/keycloak/themes/api-platform-demo
64-
- ./helm/api-platform/keycloak/config:/opt/bitnami/keycloak/data/import
62+
- ./helm/api-platform/keycloak/themes/api-platform-demo:/opt/keycloak/themes/api-platform-demo
63+
- ./helm/api-platform/keycloak/config:/opt/keycloak/data/import

‎compose.prod.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,5 +43,5 @@ services:
4343
context: ./helm/api-platform/keycloak/
4444
target: keycloak
4545
environment:
46-
KEYCLOAK_PRODUCTION: "true"
46+
KC_PRODUCTION: "true"
4747
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD}

‎compose.yaml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -104,20 +104,20 @@ services:
104104
keycloak:
105105
image: app_keycloak
106106
environment:
107-
KEYCLOAK_DATABASE_HOST: keycloak-database
108-
KEYCLOAK_DATABASE_NAME: ${KEYCLOAK_POSTGRES_DB:-keycloak}
109-
KEYCLOAK_DATABASE_USER: ${KEYCLOAK_POSTGRES_USER:-keycloak}
110-
KEYCLOAK_DATABASE_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD:-!ChangeMe!}
107+
KC_DB: postgres
108+
KC_DB_URL: jdbc:postgresql://keycloak-database:5432/${KEYCLOAK_POSTGRES_DB:-keycloak}
109+
KC_DB_USERNAME: ${KEYCLOAK_POSTGRES_USER:-keycloak}
110+
KC_DB_PASSWORD: ${KEYCLOAK_POSTGRES_PASSWORD:-!ChangeMe!}
111111
KC_BOOTSTRAP_ADMIN_USERNAME: ${KC_BOOTSTRAP_ADMIN_USERNAME:-admin}
112112
KC_BOOTSTRAP_ADMIN_PASSWORD: ${KC_BOOTSTRAP_ADMIN_PASSWORD:-!ChangeMe!}
113-
# Must finish with a trailing slash (https://github.com/bitnami/charts/issues/10885#issuecomment-1414279144)
114-
KEYCLOAK_HTTP_RELATIVE_PATH: /oidc/
115-
KEYCLOAK_HOSTNAME: https://${SERVER_NAME:-localhost}/oidc/
116-
KEYCLOAK_HOSTNAME_ADMIN: https://${SERVER_NAME:-localhost}/oidc/
117-
KEYCLOAK_ENABLE_HEALTH_ENDPOINTS: "true"
118-
# https://www.keycloak.org/server/all-config#category-health
113+
# Must finish with a trailing slash
114+
KC_HTTP_RELATIVE_PATH: /oidc/
115+
KC_HOSTNAME: https://${SERVER_NAME:-localhost}/oidc/
116+
KC_HOSTNAME_ADMIN: https://${SERVER_NAME:-localhost}/oidc/
117+
KC_HEALTH_ENABLED: "true"
118+
KC_METRICS_ENABLED: "true"
119119
healthcheck:
120-
test: [ "CMD-SHELL", "curl http://127.0.0.1:8080/oidc/health || exit 1"]
120+
test: ["CMD-SHELL", "bash -c ':> /dev/tcp/localhost/8080'"]
121121
start_period: 15s
122122
interval: 5s
123123
timeout: 3s

‎helm/api-platform/Chart.lock‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
dependencies:
22
- name: external-dns
33
repository: https://charts.bitnami.com/bitnami/
4-
version: 7.5.6
5-
- name: keycloak
6-
repository: https://charts.bitnami.com/bitnami/
7-
version: 21.4.2
8-
digest: sha256:2eeb31600fc84010057a78979e8f015a3dc5ac27cd6f17e615e6e500668ecebe
9-
generated: "2025-11-03T15:07:19.08338873+01:00"
4+
version: 9.0.3
5+
digest: sha256:3b0229942127a01c02f151e18b739c39b68e6458c6b865e3a3dd90fcfe198c99
6+
generated: "2026-02-04T16:01:05.816182082+01:00"

‎helm/api-platform/Chart.yaml‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,6 @@ appVersion: 4.2.15
2626

2727
dependencies:
2828
- name: external-dns
29-
version: 7.5.6
29+
version: 9.0.3
3030
repository: https://charts.bitnami.com/bitnami/
3131
condition: external-dns.enabled
32-
- name: keycloak
33-
version: 21.4.2
34-
repository: https://charts.bitnami.com/bitnami/
35-
condition: keycloak.enabled

‎helm/api-platform/keycloak/Dockerfile‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,26 @@
44

55

66
# Versions
7-
FROM docker.io/bitnamilegacy/keycloak:26-debian-12 AS keycloak_upstream
8-
7+
FROM quay.io/keycloak/keycloak:26.4 AS keycloak_upstream
98

109
# The different stages of this Dockerfile are meant to be built into separate images
1110
# https://docs.docker.com/develop/develop-images/multistage-build/#stop-at-a-specific-build-stage
1211
# https://docs.docker.com/compose/compose-file/#target
1312

1413

14+
# Builder
15+
FROM keycloak_upstream AS keycloak_builder
16+
17+
WORKDIR /opt/keycloak
18+
19+
RUN /opt/keycloak/bin/kc.sh build
20+
1521
# Keycloak image
1622
FROM keycloak_upstream AS keycloak
1723

18-
COPY --link themes/api-platform-demo /opt/bitnami/keycloak/themes/api-platform-demo
19-
COPY --link providers/owner-policy.jar /opt/bitnami/keycloak/providers/owner-policy.jar
24+
COPY --from=keycloak_builder /opt/keycloak/ /opt/keycloak/
25+
26+
COPY --link --chown=keycloak:keycloak --chmod=644 themes/api-platform-demo /opt/keycloak/themes/api-platform-demo
27+
COPY --link --chown=keycloak:keycloak --chmod=644 providers/owner-policy.jar /opt/keycloak/providers/owner-policy.jar
28+
29+
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

‎helm/api-platform/templates/_helpers.tpl‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,18 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
5454
app.kubernetes.io/managed-by: {{ .Release.Service }}
5555
{{- end }}
5656

57+
{{/*
58+
Common labels Keycloak
59+
*/}}
60+
{{- define "api-platform.labelsKeycloak" -}}
61+
helm.sh/chart: {{ include "api-platform.chart" . }}
62+
{{ include "api-platform.selectorLabelsKeycloak" . }}
63+
{{- if .Chart.AppVersion }}
64+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
65+
{{- end }}
66+
app.kubernetes.io/managed-by: {{ .Release.Service }}
67+
{{- end }}
68+
5769
{{/*
5870
Selector labels
5971
*/}}
@@ -72,6 +84,15 @@ app.kubernetes.io/instance: {{ .Release.Name }}
7284
app.kubernetes.io/part-of: {{ include "api-platform.name" . }}
7385
{{- end }}
7486

87+
{{/*
88+
Selector labels Keycloak
89+
*/}}
90+
{{- define "api-platform.selectorLabelsKeycloak" -}}
91+
app.kubernetes.io/name: {{ include "api-platform.name" . }}-keycloak
92+
app.kubernetes.io/instance: {{ .Release.Name }}
93+
app.kubernetes.io/part-of: {{ include "api-platform.name" . }}
94+
{{- end }}
95+
7596
{{/*
7697
Selector labels Fixtures
7798
*/}}

‎helm/api-platform/templates/configmap.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,22 @@ data:
1919
next-auth-url: "https://{{ (first .Values.ingress.hosts).host }}/api/auth"
2020
pwa-client-id: {{ .Values.pwa.oidcClientId | quote }}
2121
pwa-authorization-client-id: {{ .Values.php.oidcClientId | quote }}
22+
{{- if .Values.keycloak.postgresql.enabled }}
23+
keycloak-database-url: {{ printf "jdbc:postgresql://%s:%s/%s" .Release.Name .Values.keycloak.postgresql.global.postgresql.auth.database | b64enc | quote }}
24+
{{- else }}
25+
keycloak-database-url: {{ .Values.keycloak.postgresql.url | b64enc | quote }}
26+
{{- end }}
2227

2328
---
2429

30+
{{- if .Values.keycloak.importRealm.enabled }}
2531
apiVersion: v1
2632
kind: ConfigMap
2733
metadata:
28-
name: keycloak-realm
34+
name: {{ include "api-platform.fullname" . }}-keycloak-realm
35+
labels:
36+
{{- include "api-platform.labelsKeycloak" . | nindent 4 }}
2937
data:
30-
{{ (.Files.Glob "keycloak/config/*").AsConfig | indent 2 }}
38+
realm.json: |
39+
{{ (.Files.Glob .Values.keycloak.importRealm.path).AsConfig | indent 2 }}
40+
{{- end }}

‎helm/api-platform/templates/keycloak-deployment.yaml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "api-platform.fullname" . }}-keycloak
5+
labels:
6+
{{- include "api-platform.labelsKeycloak" . | nindent 4 }}
7+
spec:
8+
{{- if not .Values.autoscaling.enabled }}
9+
replicas: {{ .Values.replicaCount }}
10+
{{- end }}
11+
selector:
12+
matchLabels:
13+
{{- include "api-platform.selectorLabelsKeycloak" . | nindent 6 }}
14+
template:
15+
metadata:
16+
{{- with .Values.podAnnotations }}
17+
annotations:
18+
{{- toYaml . | nindent 8 }}
19+
{{- end }}
20+
labels:
21+
{{- include "api-platform.selectorLabelsKeycloak" . | nindent 8 }}
22+
spec:
23+
{{- with .Values.imagePullSecrets }}
24+
imagePullSecrets:
25+
{{- toYaml . | nindent 8 }}
26+
{{- end }}
27+
serviceAccountName: {{ include "api-platform.serviceAccountName" . }}
28+
securityContext:
29+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
30+
containers:
31+
- name: {{ .Chart.Name }}-keycloak
32+
securityContext:
33+
{{- toYaml .Values.securityContext | nindent 12 }}
34+
image: "{{ .Values.keycloak.image.repository }}:{{ .Values.keycloak.image.tag | default .Chart.AppVersion }}"
35+
imagePullPolicy: {{ .Values.keycloak.image.pullPolicy }}
36+
{{- if .Values.keycloak.importRealm.enabled }}
37+
args: ['--import-realm']
38+
volumeMounts:
39+
- name: keycloak-realm
40+
mountPath: /opt/keycloak/data/import
41+
readOnly: true
42+
{{- end }}
43+
env:
44+
- name: KC_PRODUCTION
45+
value: "true"
46+
- name: KC_HTTP_RELATIVE_PATH
47+
value: "/oidc/"
48+
- name: KC_HEALTH_ENABLED
49+
value: "true"
50+
- name: KC_METRICS_ENABLED
51+
value: "true"
52+
- name: KC_DB
53+
value: "postgres"
54+
- name: KC_DB_URL
55+
valueFrom:
56+
configMapKeyRef:
57+
name: {{ include "api-platform.fullname" . }}
58+
key: keycloak-database-url
59+
- name: KC_DB_USERNAME
60+
valueFrom:
61+
secretKeyRef:
62+
name: {{ include "api-platform.fullname" . }}
63+
key: keycloak-database-username
64+
- name: KC_DB_PASSWORD
65+
valueFrom:
66+
secretKeyRef:
67+
name: {{ include "api-platform.fullname" . }}
68+
key: keycloak-database-password
69+
- name: KC_BOOTSTRAP_ADMIN_USERNAME
70+
valueFrom:
71+
secretKeyRef:
72+
name: {{ include "api-platform.fullname" . }}
73+
key: keycloak-database-password
74+
{{- if .Values.keycloak.auth.createAdminUser }}
75+
- name: KC_BOOTSTRAP_ADMIN_USERNAME
76+
valueFrom:
77+
secretKeyRef:
78+
name: {{ include "api-platform.fullname" . }}
79+
key: keycloak-admin-username
80+
- name: KC_BOOTSTRAP_ADMIN_PASSWORD
81+
valueFrom:
82+
secretKeyRef:
83+
name: {{ include "api-platform.fullname" . }}
84+
key: keycloak-admin-password
85+
{{- end }}
86+
{{- toYaml .Values.keycloak.extraEnvVars | nindent 12 }}
87+
ports:
88+
- name: http
89+
containerPort: 8080
90+
protocol: TCP
91+
- name: https
92+
containerPort: 8443
93+
protocol: TCP
94+
- name: api
95+
containerPort: 9000
96+
protocol: TCP
97+
livenessProbe:
98+
httpGet:
99+
path: /
100+
port: http
101+
readinessProbe:
102+
httpGet:
103+
path: /
104+
port: http
105+
resources:
106+
{{- toYaml .Values.keycloak.resources | nindent 12 }}
107+
{{- if .Values.keycloak.postgresql.enabled }}
108+
- name: {{ .Chart.Name }}-keycloak-postgresql
109+
securityContext:
110+
{{- toYaml .Values.securityContext | nindent 12 }}
111+
image: "{{ .Values.keycloak.postgresql.image.repository }}:{{ .Values.keycloak.postgresql.image.tag | default .Chart.AppVersion }}"
112+
imagePullPolicy: {{ .Values.keycloak.postgresql.image.pullPolicy | default "IfNotPresent" }}
113+
env:
114+
- name: POSTGRES_DB
115+
valueFrom:
116+
secretKeyRef:
117+
name: {{ include "api-platform.fullname" . }}
118+
key: keycloak-database-name
119+
- name: POSTGRES_USER
120+
valueFrom:
121+
secretKeyRef:
122+
name: {{ include "api-platform.fullname" . }}
123+
key: keycloak-database-username
124+
- name: POSTGRES_PASSWORD
125+
valueFrom:
126+
secretKeyRef:
127+
name: {{ include "api-platform.fullname" . }}
128+
key: keycloak-database-password
129+
{{- toYaml .Values.keycloak.postgresql.extraEnvVars | nindent 12 }}
130+
ports:
131+
- name: main
132+
containerPort: 5432
133+
protocol: UDP
134+
livenessProbe:
135+
httpGet:
136+
path: /
137+
port: main
138+
readinessProbe:
139+
httpGet:
140+
path: /
141+
port: main
142+
resources:
143+
{{- toYaml .Values.keycloak.postgresql.resources | nindent 12 }}
144+
{{- end }}
145+
{{- if .Values.keycloak.importRealm.enabled }}
146+
volumes:
147+
- name: keycloak-realm
148+
configMap:
149+
name: {{ include "api-platform.fullname" . }}-keycloak-realm
150+
{{- end }}
151+
{{- with .Values.nodeSelector }}
152+
nodeSelector:
153+
{{- toYaml . | nindent 8 }}
154+
{{- end }}
155+
{{- with .Values.affinity }}
156+
affinity:
157+
{{- toYaml . | nindent 8 }}
158+
{{- end }}
159+
{{- with .Values.tolerations }}
160+
tolerations:
161+
{{- toYaml . | nindent 8 }}
162+
{{- end }}

0 commit comments

Comments
 (0)