Migration to Keycloak v25

projectsyn · Nov 20, 2024 · dca2114 · dca2114
1 parent 5d55f8f
commit dca2114
Show file tree

Hide file tree

Showing 33 changed files with 132 additions and 103 deletions.
diff --git a/class/defaults.yml b/class/defaults.yml
@@ -43,7 +43,7 @@ parameters:
       keycloak:
         registry: quay.io
         repository: keycloak/keycloak
-        tag: 24.0.5
+        tag: 25.0.6
       busybox:
         registry: docker.io
         repository: busybox
@@ -59,7 +59,7 @@ parameters:
     charts:
       keycloakx:
         source: https://codecentric.github.io/helm-charts
-        version: v2.3.0
+        version: 2.5.1
       postgresql:
         source: https://charts.bitnami.com/bitnami
         version: 12.12.10
@@ -189,6 +189,8 @@ parameters:
         tag: ${keycloak:images:keycloak:tag}
       http:
         relativePath: ${keycloak:relativePath}
+        # Required because the Keycloak management port is HTTPS by default but the keycloakx helm chart has a default to HTTP
+        internalScheme: HTTPS
       replicas: ${keycloak:replicas}
       statefulsetLabels: ${keycloak:labels}
       resources: ${keycloak:resources}
@@ -197,7 +199,6 @@ parameters:
       # See https://www.keycloak.org/server/all-config
       args:
         - start
-        - --http-enabled=true # Helm chart requires it currently
 
       # extraEnv *MUST* be a string, as it's fed through a templating
       # function.
@@ -286,10 +287,6 @@ parameters:
         image:
           repository: ${keycloak:images:busybox:registry}/${keycloak:images:busybox:repository}
           tag: ${keycloak:images:busybox:tag}
-      proxy:
-        enabled: 'true'
-        mode: ${keycloak:ingress:tls:termination}
-
       metrics:
         enabled: ${keycloak:monitoring:enabled}
       database:

diff --git a/tests/golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/ingress.yaml b/tests/golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/ingress.yaml
@@ -10,8 +10,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-builtin
 spec:

diff --git a/...lden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml b/...lden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml
@@ -5,8 +5,8 @@ metadata:
     app.kubernetes.io/instance: keycloakx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: keycloakx
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-builtin
 spec:

diff --git a/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/prometheusrule.yaml b/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/prometheusrule.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-builtin
 spec:

diff --git a/...n/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/service-headless.yaml b/...n/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/service-headless.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloakx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: keycloakx
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-headless
   namespace: syn-builtin
 spec:

diff --git a/...olden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/service-http.yaml b/...olden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/service-http.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-http
   namespace: syn-builtin
 spec:

diff --git a/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/serviceaccount.yaml b/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/serviceaccount.yaml
@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-builtin
diff --git a/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/servicemonitor.yaml b/...den/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/servicemonitor.yaml
@@ -6,15 +6,16 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-keycloakx
   namespace: syn-builtin
 spec:
   endpoints:
     - interval: 10s
       path: /metrics
-      port: http
+      port: http-internal
+      scheme: https
       scrapeTimeout: 10s
   selector:
     matchLabels:

diff --git a/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...golden/builtin/builtin/builtin/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: builtin
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-builtin
 spec:
@@ -56,7 +56,6 @@ spec:
       containers:
         - args:
             - start
-            - --http-enabled=true
           env:
             - name: FOO
               value: bar
@@ -86,37 +85,44 @@ spec:
               value: /etc/x509/https/tls.crt
             - name: KC_HTTPS_CERTIFICATE_KEY_FILE
               value: /etc/x509/https/tls.key
+            - name: KC_HTTP_ENABLED
+              value: 'true'
             - name: KC_HTTP_RELATIVE_PATH
               value: /
             - name: KC_METRICS_ENABLED
               value: 'true'
-            - name: KC_PROXY
-              value: reencrypt
+            - name: KC_PROXY_HEADERS
+              value: forward
           envFrom:
             - secretRef:
                 name: keycloak-admin-user
             - secretRef:
                 name: keycloak-postgresql
-          image: quay.io/keycloak/keycloak:24.0.5
+          image: quay.io/keycloak/keycloak:25.0.6
           imagePullPolicy: IfNotPresent
           livenessProbe:
             httpGet:
               path: /health/live
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
           ports:
             - containerPort: 8080
               name: http
               protocol: TCP
+            - containerPort: 9000
+              name: http-internal
+              protocol: TCP
             - containerPort: 8443
               name: https
               protocol: TCP
           readinessProbe:
             httpGet:
               path: /health/ready
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -133,7 +139,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /health
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/.../golden/external/external/external/01_keycloak_helmchart/keycloakx/templates/ingress.yaml b/.../golden/external/external/external/01_keycloak_helmchart/keycloakx/templates/ingress.yaml
@@ -9,8 +9,8 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-external
 spec:

diff --git a/...n/external/external/external/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml b/...n/external/external/external/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml
@@ -5,8 +5,8 @@ metadata:
     app.kubernetes.io/instance: keycloakx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: keycloakx
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-external
 spec:

diff --git a/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/prometheusrule.yaml b/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/prometheusrule.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-external
 spec:

diff --git a/...xternal/external/external/01_keycloak_helmchart/keycloakx/templates/service-headless.yaml b/...xternal/external/external/01_keycloak_helmchart/keycloakx/templates/service-headless.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: keycloakx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: keycloakx
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-headless
   namespace: syn-external
 spec:

diff --git a/...en/external/external/external/01_keycloak_helmchart/keycloakx/templates/service-http.yaml b/...en/external/external/external/01_keycloak_helmchart/keycloakx/templates/service-http.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-http
   namespace: syn-external
 spec:

diff --git a/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/serviceaccount.yaml b/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/serviceaccount.yaml
@@ -8,7 +8,7 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-external
diff --git a/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/servicemonitor.yaml b/.../external/external/external/01_keycloak_helmchart/keycloakx/templates/servicemonitor.yaml
@@ -6,15 +6,16 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx-keycloakx
   namespace: syn-external
 spec:
   endpoints:
     - interval: 10s
       path: /metrics
-      port: http
+      port: http-internal
+      scheme: https
       scrapeTimeout: 10s
   selector:
     matchLabels:

diff --git a/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml b/...den/external/external/external/01_keycloak_helmchart/keycloakx/templates/statefulset.yaml
@@ -6,8 +6,8 @@ metadata:
     app.kubernetes.io/instance: external
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-external
 spec:
@@ -56,7 +56,6 @@ spec:
       containers:
         - args:
             - start
-            - --http-enabled=true
           env:
             - name: JAVA_OPTS
               value: -XX:MaxRAMPercentage=50.0 -Djgroups.dns.query=keycloakx-headless
@@ -84,37 +83,44 @@ spec:
               value: /etc/x509/https/tls.crt
             - name: KC_HTTPS_CERTIFICATE_KEY_FILE
               value: /etc/x509/https/tls.key
+            - name: KC_HTTP_ENABLED
+              value: 'true'
             - name: KC_HTTP_RELATIVE_PATH
               value: /
             - name: KC_METRICS_ENABLED
               value: 'true'
-            - name: KC_PROXY
-              value: passthrough
+            - name: KC_PROXY_HEADERS
+              value: forwarded
           envFrom:
             - secretRef:
                 name: keycloak-admin-user
             - secretRef:
                 name: keycloak-postgresql
-          image: quay.io/keycloak/keycloak:24.0.5
+          image: quay.io/keycloak/keycloak:25.0.6
           imagePullPolicy: IfNotPresent
           livenessProbe:
             httpGet:
               path: /health/live
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 0
             timeoutSeconds: 5
           name: keycloak
           ports:
             - containerPort: 8080
               name: http
               protocol: TCP
+            - containerPort: 9000
+              name: http-internal
+              protocol: TCP
             - containerPort: 8443
               name: https
               protocol: TCP
           readinessProbe:
             httpGet:
               path: /health/ready
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 10
             timeoutSeconds: 1
           resources:
@@ -131,7 +137,8 @@ spec:
             failureThreshold: 60
             httpGet:
               path: /health
-              port: http
+              port: http-internal
+              scheme: HTTPS
             initialDelaySeconds: 15
             periodSeconds: 5
             timeoutSeconds: 1

diff --git a/...nshift-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/ingress.yaml b/...nshift-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/ingress.yaml
@@ -10,8 +10,8 @@ metadata:
     app.kubernetes.io/instance: openshift-postgres
     app.kubernetes.io/managed-by: commodore
     app.kubernetes.io/name: keycloak
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-openshift-postgres
 spec:

diff --git a/...-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml b/...-postgres/openshift-postgres/01_keycloak_helmchart/keycloakx/templates/networkpolicy.yaml
@@ -5,8 +5,8 @@ metadata:
     app.kubernetes.io/instance: keycloakx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/name: keycloakx
-    app.kubernetes.io/version: 24.0.5
-    helm.sh/chart: keycloakx-2.3.0
+    app.kubernetes.io/version: 25.0.6
+    helm.sh/chart: keycloakx-2.5.1
   name: keycloakx
   namespace: syn-openshift-postgres
 spec: