first commit

.gitignore

@@ -0,0 +1,38 @@
+# Local .terraform directories
+**/.terraform/*
+
+# terraform lock file.
+**/.terraform.lock.hcl
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data,
+# such as password, private keys, and other secrets. These should not be
+# part of version control as they are data points which are potentially
+# sensitive and subject to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources
+# locally and so are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+

copy_images.tf

@@ -0,0 +1,45 @@
+locals {
+  keycloak_key = format("%v#%v", "keycloak", var.keycloak_tag)
+  gogatekeeper_key = format("%v#%v", "gogatekeeper", var.gogatekeeper_tag)
+
+  image_config = [
+    {
+      enabled         = true
+      dest_path       = null
+      name            = "keycloak"
+      source_image    = "bitnami/keycloak"
+      source_registry = "docker.io"
+      source_tag      = var.keycloak_tag
+      tag             = var.keycloak_tag
+    },
+    {
+      enabled         = true
+      dest_path       = null
+      name            = "gogatekeeper"
+      source_image    = "gogatekeeper/gatekeeper"
+      source_registry = "quay.io"
+      source_tag      = var.gogatekeeper_tag
+      tag             = var.gogatekeeper_tag
+    },
+  ]
+}
+
+module "images" {
+  source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=2.0.2"
+
+  profile          = var.profile
+  application_name = var.cluster_name
+  image_config     = local.image_config
+  tags             = {}
+
+  ### optional
+  ##  account_alias        = ""
+  ##  account_id           = ""
+  ##  destination_password = ""
+  ##  destination_username = ""
+  ##  override_prefixes    = {}
+  ##  region               = ""
+  ##  source_password      = ""
+  ##  source_username      = ""
+}
+

keycloak-values.yaml.tmpl

@@ -0,0 +1,73 @@
+replicaCount: 3
+
+global:
+  imageRegistry: "${image_registry}"
+
+image:
+  registry: "${image_registry}"
+  repository: "${image_repository}"
+  tag: "${image_tag}"
+
+postgresql:
+  enabled: false
+
+auth:
+  adminUser: "admin"
+  existingSecret: "keycloak-admin-creds"
+  passwordSecretKey: "keycloak-password"
+
+service:
+  type: "ClusterIP"
+
+production: true
+proxy: "edge"
+
+extraEnvVars:
+- name: PROXY_ADDRESS_FORWARDING
+  value: "true"
+- name: KC_CONFIG_FILE
+  value: "/opt/bitnami/keycloak/kcadm.config"
+- name: DB_VENDOR
+  value: "${external_db_type}"
+
+metrics:
+  enabled: true
+
+externalDatabaes:
+  host: "${external_db_addr}"
+  port: "${external_db_port}"
+  user: "${external_db_user}"
+  database: "${external_db_database}"
+  existingSecret: "keycloak-db-creds"
+  existingSecretPasswordKey: "database-password"
+
+extraVolumeMounts: |
+  - name: keycloak-db-creds
+    mountPath: /secrets/keycloak-db-creds
+    readOnly: true
+  - name: keycloak-admin-creds
+    mountPath: /secrets/keycloak-admin-creds
+    readOnly: true
+
+extraVolumes: |
+  - name: keycloak-db-creds
+    secret:
+      secretName: keycloak-db-creds
+  - name: keycloak-admin-creds
+    secret:
+      secretName: keycloak-admin-creds
+
+extraEnv: |
+  - name: DB_PASSWORD_FILE
+    value: /secrets/keycloak-db-creds/database-password
+  - name: KEYCLOAK_PASSWORD_FILE
+    value: /secrets/keycloak-admin-creds/keycloak-password
+  - name: JGROUPS_DISCOVERY_PROTOCOL
+    value: dns.DNS_PING
+  - name: JGROUPS_DISCOVERY_PROPERTIES
+    value: 'dns_query={{ include "keycloak.serviceDnsName" . }}'
+  - name: CACHE_OWNERS_COUNT
+    value: "3"
+  - name: CACHE_OWNERS_AUTH_SESSIONS_COUNT
+    value: "3"
+

main.tf

@@ -0,0 +1,62 @@
+locals {
+  secrets_job_script = <<SECRETS
+ensure_secret keycloak-db-creds database-password "${var.external_database_password}"
+ensure_secret keycloak-admin-creds keycloak-password $(mkpasswd 32 false)
+SECRETS
+}
+
+resource "kubernetes_namespace" "keycloak" {
+  metadata {
+    name = var.keycloak_namespace
+    labels = {
+      istio-injection = "enabled"
+    }
+  }
+}
+
+module "service_account" {
+  #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//service-account?ref=1.0.0"
+  source = "git@github.it.census.gov:SOA/tfmod-config-job.git//service-account"
+
+  namespace = kubernetes_namespace.keycloak.metadata[0].name
+}
+
+module "pre_install" {
+  #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job?ref=1.0.0"
+  source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job"
+
+  namespace            = kubernetes_namespace.keycloak.metadata[0].name
+  service_account_name = module.service_account.service_account_name
+  job_name             = "keycloak-config-secret-job"
+  config_script        = local.secrets_job_script
+}
+
+resource "helm_release" "keycloak" {
+  chart      = "keycloak"
+  name       = "keycloak"
+  repository = "https://charts.bitnami.com/bitnami"
+  namespace  = kubernetes_namespace.keycloak.metadata[0].name
+  values = [templatefile("${path.module}/keycloak-values.yaml.tmpl", {
+    image_registry       = module.images.images[local.keycloak_key].dest_registry,
+    image_repository     = module.images.images[local.keycloak_key].dest_repository,
+    image_tag            = module.images.images[local.keycloak_key].tag,
+    external_db_type     = var.external_database_vendor
+    external_db_addr     = var.external_database_address
+    external_db_port     = var.external_database_port
+    external_db_database = var.external_database_database
+    external_db_user     = var.external_database_username
+  })]
+}
+
+module "service-ingress" {
+  #source = "git@github.it.census.gov:SOA/tfmod-service-ingress-istio-simple.git/?ref=1.0.0"
+  source = "git@github.it.census.gov:SOA/tfmod-service-ingress-istio-simple.git/"
+
+  publicHostname    = var.keycloak_hostname
+  publicDomain      = var.cluster_domain
+  certificateIssuer = var.certificate_issuer
+  istioNamespace    = var.istio_namespace
+  serviceName       = "keycloak-http"
+  serviceNamespace  = helm_release.keycloak.namespace
+  servicePortNumber = "80"
+}

outputs.tf

@@ -0,0 +1,30 @@
+output "keycloak_fqdn" {
+  description = "The URL to use to retrieve the OpenID configuration"
+  value = format("https://%v.%v/", var.keycloak_hostname, var.cluster_domain)
+}
+
+output "gogatekeeper_chart_version" {
+  description = "The version of the gogatekeeper chart prepared"
+  value = var.gogatekeeper_version
+}
+
+output "gogatekeeper_registry" {
+  description = "Installed gogatekeeper in this registry"
+  value = module.images.images[local.gogatekeeper_key].dest_registry
+}
+
+output "gogatekeeper_repository" {
+  description = "Installed gogatekeeper in this repository"
+  value = module.images.images[local.gogatekeeper_key].dest_repository
+}
+
+output "gogatekeeper_full_path" {
+  description = "Installed gogatekeeper with this full path"
+  value = module.images.images[local.gogatekeeper_key].dest_full_path
+}
+
+output "gogatekeeper_tag" {
+  description = "Installed gogatekeeper with this tag"
+  value = module.images.images[local.gogatekeeper_key].tag
+}
+

variables.tf

@@ -0,0 +1,97 @@
+variable "cluster_name" {
+  description = "EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev)"
+  type        = string
+}
+
+variable "profile" {
+  description = "AWS config profile used to upload images into ECR"
+  type        = string
+  default     = ""
+}
+
+variable "keycloak_namespace" {
+  description = "The namespace which will be created and into which keycloak will be deployed."
+  default     = "keycloak"
+}
+
+# helm repo add bitnami https://charts.bitnami.com/bitnami
+# helm search repo bitnami/keycloak
+variable "keycloak_version" {
+  description = "The version of the bitnami keycloak helm chart to install."
+  default     = "16.1.2"
+}
+
+# determine using:
+# helm show values bitnami/keycloak | grep tag:
+# Use the first value, not the second (which is for bitnami/keycloak-config-cli
+variable "keycloak_tag" {
+  description = "The image tag associated with the keycloak_chart_version"
+  default     = "22.0.1-debian-11-r30"
+}
+
+# helm repo add gogatekeeper https://gogatekeeper.github.io/helm-gogatekeeper
+# helm search repo gogatekeeper/gatekeeper
+variable "gogatekeeper_version" {
+   description = "The version of the gogatekeeper helm chart that is the basis for gogatekeeper deployments."
+   default = "0.1.37"
+}
+
+variable "gogatekeeper_tag" {
+  description = "The tag associated with the gogatekeeper_version"
+  default = "2.6.2"
+}
+
+# Keycloak will be accessible at <keycloak_hostname>.<cluster_domain>
+variable "keycloak_hostname" {
+  description = "The hostname used to access the keycloak service."
+  default     = "keycloak"
+}
+
+variable "cluster_domain" {
+  description = "The domain name used to reference ingresses for the cluster."
+}
+
+variable "certificate_issuer" {
+  description = "The name of the certificate issuer to use for ingresses."
+}
+
+variable "istio_namespace" {
+  description = "The namespace in which the certificate request is to be created."
+  default     = "istio-system"
+}
+
+variable "default_realm" {
+  description = "The default realm to use to configure the environment."
+  default     = "cluster-admin"
+}
+
+variable "admin_email" {
+  description = "The email address of the admin of the default realm."
+}
+
+variable "external_database_vendor" {
+  description = "The type of database keycloak will be using to store configuration data. mariadb/mssql/mysql/oracle/postgres"
+  default     = "postgresql"
+}
+
+variable "external_database_address" {
+  description = "The address to access the external database. for example: `adsd-rds-mft-sbox.c2tx3ocukdth.us-gov-east-1.rds.amazonaws.com`"
+}
+
+variable "external_database_port" {
+  description = "The port to use to access the database."
+}
+
+variable "external_database_database" {
+  description = "The name of the database within which keycloak should maintain configuration data."
+  default     = "keycloak"
+}
+
+variable "external_database_username" {
+  description = "The username keycloak should use to log into the external database."
+  default     = "keycloak"
+}
+
+variable "external_database_password" {
+  description = "The password for the external_database_username user."
+}