Automate DB config and minor keycloak config adjustments

main.tf

@@ -23,8 +23,8 @@ ensure_secret admin-sso client_secret "${random_uuid.admin-secret.result}"
 SECRETS
 
   config_job_script = <<CONFIG
-rootUrl="${local.public_url}/"
-redirectUrl="${local.public_url}/"
+rootUrl=""
+redirectUrl="https://*"
 login && \
 create_realm ${var.default_realm} && \
 create_admin_user ${var.default_realm} \
@@ -42,6 +42,21 @@ add_mapper_to_client "${var.default_realm}" \
 	"realm roles" "openid-connect" "oidc-usermodel-realm-role-mapper" \
 	"{ \"multivalued\": \"true\", \"userinfo.token.claim\": \"true\", \"user.attribute\": \"foo\", \"id.token.claim\": \"true\", \"access.token.claim\": \"true\", \"claim.name\": \"realm_access.roles\", \"jsonType.label\": \"String\" }" && \
 restart_server
+CONFIG
+
+  db_config_job_script = <<CONFIG
+echo "Starting DB Config Job"
+cat > /tmp/db_config.sql <<EOF
+CREATE ROLE keycloak LOGIN PASSWORD '${data.kubernetes_secret.db-secrets.data.password}';
+ALTER DATABASE keycloak OWNER TO keycloak;
+COMMIT;
+EOF
+do_kubectl_cp /tmp/db_config.sql keycloak-db-postgresql-0 /tmp/db_config.sql
+do_kubectl exec -n keycloak -t keycloak-db-postgresql-0 -c postgresql -- \
+  /opt/bitnami/postgresql/bin/psql \
+  postgresql://postgres:${data.kubernetes_secret.db-secrets.data.password}@keycloak-db-postgresql.keycloak.svc.cluster.local:5432/keycloak \
+  -f /tmp/db_config.sql
+echo "End DB Config Job"
 CONFIG
 }
 
@@ -71,6 +86,7 @@ module "pre_install" {
   job_name             = "keycloak-config-secret-job"
   config_script        = local.secrets_job_script
   kubectl_img          = module.images.images[local.kubectl_key].dest_full_path
+  init_img             = module.images.images[local.kubectl_key].dest_full_path
 
   timeout = "5m"
 }
@@ -112,21 +128,22 @@ data "kubernetes_secret" "db-secrets" {
   }
 }
 
-# resource "postgresql_role" "keycloak-role" {
-#   depends_on = [ helm_release.keycloak-db ]
-#   name     = "keycloak"
-#   login    = true
-#   password = data.kubernetes_secret.db-secrets.data.password
-# }
-
-# resource "postgresql_database" "keycloak-db" {
-#   name              = "keycloak-db"
-#   owner             = postgresql_role.keycloak-role.name
-#   template          = "template0"
-#   lc_collate        = "C"
-#   connection_limit  = -1
-#   allow_connections = true
-# }
+module "keycloak_db_config" {
+  #source = "git@github.it.census.gov:SOA/tfmod-config-job.git//config-job?ref=1.0.0"
+  # source = "git@github.e.it.census.gov:SCT-Engineering/tfmod-config-job.git//config-job?ref=feature-kiali-baseline"
+  source     = "/data/terraform/workspaces/mcgin314/tfmod-config-job//config-job"
+
+  depends_on = [ helm_release.keycloak-db ]
+
+  namespace            = kubernetes_namespace.keycloak.metadata[0].name
+  service_account_name = module.service_account.service_account_name
+  job_name             = "keycloak-db-config-job"
+  config_script        = local.db_config_job_script
+  kubectl_img          = module.images.images[local.kubectl_key].dest_full_path
+  init_img             = module.images.images[local.kubectl_key].dest_full_path
+
+  timeout = "3m"
+}
 
 resource "helm_release" "keycloak" {
   chart      = "keycloakx"
@@ -181,6 +198,7 @@ module "post_install" {
   job_name             = "keycloak-config-job"
   config_script        = local.config_job_script
   kubectl_img          = module.images.images[local.kubectl_key].dest_full_path
+  init_img             = module.images.images[local.kubectl_key].dest_full_path
 
   timeout = "10m"
 }

outputs.tf

@@ -1,8 +1,3 @@
-output "public_endpoint" {
-  description = "The endpoint at which keycloak can be reached from outside the cluster."
-  value       = module.ingress_resources.service_url
-}
-
 output "admin_internal_endpoint" {
   description = "internal endpoint for admin"
   value = {
@@ -12,6 +7,11 @@ output "admin_internal_endpoint" {
   }
 }
 
+output "public_endpoint" {
+  description = "The endpoint at which keycloak can be reached from outside the cluster."
+  value       = module.ingress_resources.service_url
+}
+
 # Add provider configuration block for easier consumption
 output "provider_config" {
   value = {