more vars

SCT-Engineering · Apr 3, 2025 · 9b8ad74 · 9b8ad74
1 parent 807a04e
commit 9b8ad74
Show file tree

Hide file tree

Showing 5 changed files with 66 additions and 70 deletions.
diff --git a/README.md b/README.md
@@ -72,7 +72,7 @@ Common issues and solutions:
 | Name | Version |
 |------|---------|
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
-| <a name="provider_keycloak"></a> [keycloak](#provider\_keycloak) | >= 5.0.0 |
+| <a name="provider_keycloak"></a> [keycloak](#provider\_keycloak) | 5.1.1 |
 | <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.35.1 |
 
 ## Modules
@@ -90,42 +90,41 @@ Common issues and solutions:
 | [keycloak_openid_client.client](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/openid_client) | resource |
 | [keycloak_realm.realm](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/realm) | resource |
 | [keycloak_role.developer_role](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/role) | resource |
-| [keycloak_user.admin_user](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/user) | resource |
-| [keycloak_user_roles.admin_roles](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/user_roles) | resource |
-| [kubernetes_secret.keycloak_admin_creds](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
+| [keycloak_user.user](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/user) | resource |
+| [keycloak_user_roles.user_roles](https://registry.terraform.io/providers/keycloak/keycloak/latest/docs/resources/user_roles) | resource |
+| [kubernetes_secret.keycloak_realm_creds](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_admin_email"></a> [admin\_email](#input\_admin\_email) | Email for the realm admin user | `string` | `"admin@example.com"` | no |
-| <a name="input_admin_password"></a> [admin\_password](#input\_admin\_password) | Password for the realm admin user | `string` | `""` | no |
-| <a name="input_admin_username"></a> [admin\_username](#input\_admin\_username) | Username for the realm admin user | `string` | `"admin"` | no |
 | <a name="input_base_url"></a> [base\_url](#input\_base\_url) | Base URL for the OpenID client | `string` | `""` | no |
 | <a name="input_client_id"></a> [client\_id](#input\_client\_id) | Client ID for the OpenID client | `string` | `"app-client"` | no |
 | <a name="input_client_secret"></a> [client\_secret](#input\_client\_secret) | Client secret for the OpenID client | `string` | `""` | no |
 | <a name="input_cluster_domain"></a> [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
 | <a name="input_default_storage_class"></a> [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no |
-| <a name="input_keycloak_admin_secret"></a> [keycloak\_admin\_secret](#input\_keycloak\_admin\_secret) | Secret key for Keycloak admin client | `string` | `""` | no |
-| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"bitnami_keycloak"` | no |
-| <a name="input_keycloak_hostname"></a> [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname for Keycloak without the domain suffix | `string` | `"keycloak-service"` | no |
-| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"bn_keycloak"` | no |
+| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no |
+| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no |
 | <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no |
-| <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"bn_keycloak"` | no |
+| <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
 | <a name="input_postgresql_tag"></a> [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no |
+| <a name="input_realm_email"></a> [realm\_email](#input\_realm\_email) | Email for the realm user | `string` | `"admin@example.com"` | no |
 | <a name="input_realm_name"></a> [realm\_name](#input\_realm\_name) | Name of the Keycloak realm to create | `string` | `"default"` | no |
+| <a name="input_realm_password"></a> [realm\_password](#input\_realm\_password) | Password for the realm user | `string` | `""` | no |
+| <a name="input_realm_user"></a> [realm\_user](#input\_realm\_user) | Username for the realm admin user | `string` | `"user"` | no |
 | <a name="input_redirect_uris"></a> [redirect\_uris](#input\_redirect\_uris) | Valid redirect URIs for the OpenID client | `list(string)` | <pre>[<br/>  "*"<br/>]</pre> | no |
 | <a name="input_root_url"></a> [root\_url](#input\_root\_url) | Root URL for the OpenID client | `string` | `""` | no |
-| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"keycloak-service"` | no |
+| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no |
 | <a name="input_telemetry_namespace"></a> [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
+| <a name="output_admin_internal_endpoint"></a> [admin\_internal\_endpoint](#output\_admin\_internal\_endpoint) | internal endpoint for admin |
 | <a name="output_client_id"></a> [client\_id](#output\_client\_id) | The client ID for accessing keycloak. |
 | <a name="output_client_secret"></a> [client\_secret](#output\_client\_secret) | The client secret for accessing keycloak. |
 | <a name="output_discovery_url"></a> [discovery\_url](#output\_discovery\_url) | The URL for discovering keycloak services. |

diff --git a/kc_bootstrap.tf b/kc_bootstrap.tf
@@ -1,9 +1,8 @@
 # Configure provider
 provider "keycloak" {
-  depends_on    = [module.ingress_resources]
-  client_id     = "admin-cli"
-  client_secret = var.keycloak_admin_secret
-  url           = "https://${var.keycloak_hostname}.${var.cluster_domain}/auth"
+  client_id     = var.keycloak_user
+  client_secret = var.keycloak_password
+  url           = "https://${module.ingress_resources.service_url}/auth"
 }
 
 # Create realm
@@ -23,24 +22,24 @@ resource "keycloak_role" "developer_role" {
 }
 
 # Create admin user
-resource "keycloak_user" "admin_user" {
+resource "keycloak_user" "user" {
   depends_on = [module.ingress_resources]
   realm_id   = keycloak_realm.realm.id
-  username   = var.admin_username
-  email      = var.admin_email
+  username   = var.realm_user
+  email      = var.realm_email
   enabled    = true
 
   initial_password {
-    value     = var.admin_password
+    value     = var.realm_password
     temporary = false
   }
 }
 
 # Assign role to user
-resource "keycloak_user_roles" "admin_roles" {
+resource "keycloak_user_roles" "user_roles" {
   depends_on = [module.ingress_resources]
   realm_id   = keycloak_realm.realm.id
-  user_id    = keycloak_user.admin_user.id
+  user_id    = keycloak_user.user.id
 
   role_ids = [
     keycloak_role.developer_role.id
@@ -59,3 +58,20 @@ resource "keycloak_openid_client" "client" {
   root_url            = var.root_url
   base_url            = var.base_url
 }
+
+# Create secret with realm creds
+resource "kubernetes_secret" "keycloak_realm_creds" {
+  metadata {
+    name      = "keycloak-${var.realm_name}-creds"
+    namespace = var.namespace
+  }
+
+  data = {
+    username      = var.realm_user
+    password      = var.realm_password
+    client-id     = var.client_id
+    client-secret = var.client_secret
+    realm-name    = var.realm_name
+  }
+
+}
diff --git a/main.tf b/main.tf
@@ -1,6 +1,7 @@
 # main.tf
 locals {
-  internal_port_number = "8080"
+  internal_port_number       = "8080"
+  admin_internal_port_number = "9000"
 }
 
 resource "helm_release" "keycloak" {
@@ -13,42 +14,26 @@ resource "helm_release" "keycloak" {
 
   namespace = var.namespace
   values = [templatefile("${path.module}/keycloak-values.yaml.tmpl", {
+    cluster_name                = var.cluster_name,
+    default_storage_class       = var.default_storage_class,
     image_registry              = module.images.images[local.keycloak_key].dest_registry,
     image_repository            = module.images.images[local.keycloak_key].dest_repository,
     image_tag                   = module.images.images[local.keycloak_key].tag,
-    default_storage_class       = var.default_storage_class,
-    serviceDnsName              = format("https://%s.%s", var.service_name, var.cluster_domain),
-    telemetry_namespace         = var.telemetry_namespace,
+    keycloak_database           = var.keycloak_database,
+    keycloak_password           = var.keycloak_password,
+    keycloak_user               = var.keycloak_user,
     postgresql_image_registry   = module.images.images[local.postgresql_key].dest_registry,
     postgresql_image_repository = module.images.images[local.postgresql_key].dest_repository,
     postgresql_image_tag        = module.images.images[local.postgresql_key].tag,
-    keycloak_database           = var.keycloak_database,
-    keycloak_user               = var.keycloak_user,
-    keycloak_password           = var.keycloak_password,
-    cluster_name                = var.cluster_name,
+    serviceDnsName              = format("https://%s.%s", var.service_name, var.cluster_domain),
+    telemetry_namespace         = var.telemetry_namespace,
   })]
 
   depends_on = [
     module.images
   ]
 }
 
-resource "kubernetes_secret" "keycloak_admin_creds" {
-  metadata {
-    name      = "keycloak-admin-creds"
-    namespace = var.namespace
-  }
-
-  data = {
-    "keycloak-username" = var.keycloak_user
-    "keycloak-password" = var.keycloak_password
-  }
-
-  depends_on = [
-    helm_release.keycloak
-  ]
-}
-
 module "ingress_resources" {
   depends_on = [helm_release.keycloak]
   # tflint-ignore: terraform_module_pinned_source

diff --git a/outputs.tf b/outputs.tf
@@ -3,6 +3,15 @@ output "public_endpoint" {
   value       = module.ingress_resources.service_url
 }
 
+output "admin_internal_endpoint" {
+  description = "internal endpoint for admin"
+  value = {
+    hostname    = format("%v.%v.svc.cluster.local", var.service_name, var.namespace)
+    port_number = local.admin_internal_port_number
+    url         = format("http://%v:%v", var.service_name, local.admin_internal_port_number)
+  }
+}
+
 output "realm_id" {
   value = keycloak_realm.realm.id
 }

diff --git a/variables.tf b/variables.tf
@@ -29,19 +29,19 @@ variable "cluster_domain" {
 variable "keycloak_database" {
   description = "The name of the database to create in the RDS instance."
   type        = string
-  default     = "bitnami_keycloak"
+  default     = "keycloak"
 }
 
 variable "keycloak_user" {
   description = "The username for the database."
   type        = string
-  default     = "bn_keycloak"
+  default     = "keycloak"
 }
 
 variable "keycloak_password" {
   description = "The initial password for the database."
   type        = string
-  default     = "bn_keycloak"
+  default     = "keycloak"
 }
 
 variable "default_storage_class" {
@@ -53,7 +53,7 @@ variable "default_storage_class" {
 variable "service_name" {
   description = "The name of the service to be deployed in the EKS cluster."
   type        = string
-  default     = "keycloak-service"
+  default     = "service"
 }
 
 variable "telemetry_namespace" {
@@ -68,39 +68,26 @@ variable "postgresql_tag" {
   default     = "17.4.0"
 }
 
-variable "keycloak_admin_secret" {
-  description = "Secret key for Keycloak admin client"
-  type        = string
-  default     = ""
-  sensitive   = true
-}
-
-variable "keycloak_hostname" {
-  description = "The hostname for Keycloak without the domain suffix"
-  type        = string
-  default     = "keycloak-service"
-}
-
 variable "realm_name" {
   description = "Name of the Keycloak realm to create"
   type        = string
   default     = "default"
 }
 
-variable "admin_username" {
+variable "realm_user" {
   description = "Username for the realm admin user"
   type        = string
-  default     = "admin"
+  default     = "user"
 }
 
-variable "admin_email" {
-  description = "Email for the realm admin user"
+variable "realm_email" {
+  description = "Email for the realm user"
   type        = string
   default     = "admin@example.com"
 }
 
-variable "admin_password" {
-  description = "Password for the realm admin user"
+variable "realm_password" {
+  description = "Password for the realm user"
   type        = string
   default     = ""
   sensitive   = true