Merge pull request #7 from SCT-Engineering/mcmCluster

[Minor] Refactor to native-ize resources

.cz.yaml

@@ -1,10 +1,11 @@
 ---
 commitizen:
-  name: cz_conventional_commits
-  tag_format: v$version
-  version: 0.1.0
-  version_files:
-    - version.tf:module_version
   bump_message: "bump: version $current_version → $new_version"
   changelog_incremental: true
+  major_version_zero: true
+  name: cz_gitmoji
+  tag_format: $version
   update_changelog_on_bump: true
+  version_files:
+    - version.tf:module_version
+  version_provider: scm

.pre-commit-config.yaml

@@ -47,7 +47,7 @@ repos:
 
 # Terraform Hooks
 - repo: https://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.98.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
+  rev: v1.99.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
   hooks:
     - id: terraform_fmt
       args:

README.md

@@ -76,8 +76,8 @@ Common issues and solutions:
 
 | Name | Version |
 |------|---------|
-| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.95.0 |
-| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 5.95.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.96.0 |
+| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | 5.96.0 |
 | <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
 | <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.36.0 |
 | <a name="provider_null"></a> [null](#provider\_null) | 3.2.4 |
@@ -89,9 +89,7 @@ Common issues and solutions:
 |------|--------|---------|
 | <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
 | <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a |
-| <a name="module_keycloak_db_config"></a> [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
 | <a name="module_post_install"></a> [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
-| <a name="module_pre_install"></a> [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
 | <a name="module_service_account"></a> [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a |
 
 ## Resources
@@ -101,11 +99,12 @@ Common issues and solutions:
 | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
 | [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
+| [kubernetes_secret.keycloak_secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
 | [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [random_password.passwords](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
 | [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
 | [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
 | [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
-| [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source |
 
 ## Inputs
 
@@ -118,10 +117,9 @@ Common issues and solutions:
 | <a name="input_default_realm"></a> [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no |
 | <a name="input_eecr_info"></a> [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | <pre>object({<br/>    account_id = string<br/>    alias      = string<br/>    profile    = string<br/>    region     = string<br/>  })</pre> | <pre>{<br/>  "account_id": "269222635945",<br/>  "alias": "lab-gov-shared-nonprod",<br/>  "profile": "269222635945-lab-gov-shared-nonprod",<br/>  "region": "us-gov-east-1"<br/>}</pre> | no |
 | <a name="input_keycloak_chart_version"></a> [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no |
-| <a name="input_keycloak_hostname"></a> [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no |
-| <a name="input_keycloak_namespace"></a> [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
 | <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no |
 | <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no |
+| <a name="input_namespace"></a> [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
 | <a name="input_postgres_exporter_tag"></a> [postgres\_exporter\_tag](#input\_postgres\_exporter\_tag) | The tag of the postgres exporter image to use. | `string` | `"17.4.0"` | no |
 | <a name="input_postgresql_chart_version"></a> [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"17.4.0"` | no |
 | <a name="input_postgresql_tag"></a> [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no |

charts/keycloakx/examples/postgresql/keycloak-server-values.yaml

@@ -33,8 +33,10 @@ database:
   vendor: postgres
   hostname: keycloak-db-postgresql
   port: 5432
-  username: dbusername
-  password: dbpassword
+  username: keycloak
+  password: keycloak
+  existingSecret: ${secret_name}
+  existingSecretKey: ${database_password_key}
   database: keycloak
 
 secrets:

config_job.tf

@@ -0,0 +1,23 @@
+locals {
+  config_job_script = <<CONFIG
+rootUrl=""
+redirectUrl="https://*"
+login && \
+create_realm ${var.default_realm} && \
+create_admin_user ${var.default_realm} \
+	"$(kc_user)" "$(kc_passwd)" "${var.admin_email}" && \
+create_realm_role ${var.default_realm} admin \
+	"Admin role for ${var.default_realm}" && \
+create_realm_role ${var.default_realm} user \
+	"User role for ${var.default_realm}" && \
+add_realm_role_to_user ${var.default_realm} user user && \
+create_client "${var.default_realm}" "${local.user_client_id}" \
+	"${random_uuid.user_secret.result}" "$rootUrl" "" \
+	"[ \"$redirectUrl\" ]" "" 1 && \
+add_mapper_to_client "${var.default_realm}" \
+	"$(get_client_id "${var.default_realm}" "${local.user_client_id}")" \
+	"realm roles" "openid-connect" "oidc-usermodel-realm-role-mapper" \
+	"{ \"multivalued\": \"true\", \"userinfo.token.claim\": \"true\", \"user.attribute\": \"foo\", \"id.token.claim\": \"true\", \"access.token.claim\": \"true\", \"claim.name\": \"realm_access.roles\", \"jsonType.label\": \"String\" }" && \
+restart_server
+CONFIG
+}

keycloak-db-values.yaml

@@ -3,17 +3,25 @@ global:
   security:
     allowInsecureImages: true
   postgresql:
-    architecture: replication
     auth:
-      database: keycloak
-      existingSecret: keycloak-db-creds
+      postgresPassword: ${postgres_password_key}
+      username: ${database_user}
+      database: ${database_name}
+      existingSecret: ${secret_name}
       secretKeys:
-        adminPasswordKey: password
-        userPasswordKey: postgres-password
-        replicationPasswordKey: replication-password
+        adminPasswordKey: ${postgres_password_key}
+        replicationPasswordKey: ${replication_password_key}
+        userPasswordKey: ${database_password_key}
+
+architecture: standalone
+
+replication:
+  applicationName: ${database_name}
 
 image:
-  registry:
+  registry: ${image_registry}
+  repository: ${image_repository}
+  tag: ${image_tag}
 
 volumePermissions:
   image:
@@ -23,7 +31,9 @@ volumePermissions:
 metrics:
   enabled: true
   image:
-    registry:
+    registry: ${metrics_registry}
+    repository: ${metrics_repository}
+    tag: ${metrics_tag}
 
 primary:
   resources:

keycloak-server-values.yaml

@@ -1,9 +1,15 @@
 # See https://www.keycloak.org/server/configuration
 # See https://www.keycloak.org/server/all-config
 
-replicas: 3
+image:
+  repository: "${image_registry}/${image_repository}"
+  tag: "${image_tag}"
 
 skipInitContainers: true
+autoscaling:
+  enabled: ${autoscaling}
+  minReplicas: 1
+  maxReplicas: 1
 
 command:
   - "/opt/keycloak/bin/kc.sh"
@@ -20,12 +26,12 @@ extraEnv: |
   - name: KC_BOOTSTRAP_ADMIN_USERNAME
     valueFrom:
       secretKeyRef:
-        name: keycloak-user-creds
+        name: ${keycloak_user_creds}
         key: username
   - name: KC_BOOTSTRAP_ADMIN_PASSWORD
     valueFrom:
       secretKeyRef:
-        name: keycloak-user-creds
+        name: ${keycloak_user_creds}
         key: password
   - name: JAVA_OPTS_APPEND
     value: >-
@@ -34,8 +40,12 @@ extraEnv: |
       -Djava.awt.headless=true
       -Djgroups.dns.query={{ include "keycloak.fullname" . }}-headless
 
-# dbchecker:
-#   enabled: true
+# Requires utilities
+dbchecker:
+  enabled: true
+  image:
+    repository: ${db_checker_image_repo}
+    tag: ${db_checker_tag}
 resources:
   requests:
     cpu: 500m
@@ -48,11 +58,17 @@ database:
   vendor: postgres
   hostname: ${database_hostname}
   port: 5432
-  username: ${database_username}
-  # password: dbpassword
-  existingSecret: keycloak-db-creds
-  existingSecretKey: password
   database: ${database_name}
+  existingSecret: ${secret_name}
+  secretKeys:
+    adminPasswordKey: ${database_password_key}
+    userPasswordKey: ${postgres_password_key}
+    replicationPasswordKey: ${replication_password_key}
+  # username: keycloak
+  # password: keycloak
+  # password: dbpassword
+  # existingSecret: ${secret_name}
+  # existingSecretKey: ${database_password_key}
 
 http:
   relativePath: "/"