Module Release Process

.github/workflows/terraform-release.yaml

@@ -0,0 +1,40 @@
+name: Terraform CI/CD
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+jobs:
+  terraform-ci-cd:
+    runs-on: 229685449397
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout code
+        uses: CSVD/gh-actions-checkout@v4
+
+      - name: Setup GITHUB Credentials
+        id: github_credentials
+        uses: CSVD/gh-auth@main
+        with:
+          github_app_pem_file: ${{ secrets.GH_APP_PEM_FILE }}
+          github_app_installation_id: ${{ vars.GH_APP_INSTALLATION_ID }}
+          github_app_id: ${{ vars.GH_APP_ID }}
+
+      - name: Setup GitHub CLI
+        run: |
+          # Force manual authentication since setup-git might not work with GitHub Enterprise
+          echo "${{ steps.github_credentials.outputs.github_token }}" > /tmp/token.txt
+          gh auth login --with-token --hostname "github.e.it.census.gov" < /tmp/token.txt
+          rm /tmp/token.txt
+
+          # Test GitHub CLI auth status
+          gh auth status || echo "GitHub CLI authentication failed"
+
+      - name: Run Release Action
+        uses: CSVD/releaser@main
+        with:
+          github-token: ${{ steps.github_credentials.outputs.github_token }}
+          working-directory: '.'

.github/workflows/terraform-validate.yaml

@@ -0,0 +1,42 @@
+name: Terraform Validate
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+
+  terraform-validate:
+    runs-on: "229685449397"
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout code
+        uses: CSVD/gh-actions-checkout@v4
+
+      - name: Setup Terraform
+        uses: CSVD/gh-actions-setup-terraform@v2
+        with:
+          terraform_version: '1.10.5'
+
+      - name: Validate Terraform Configuration
+        id: validate
+        uses: CSVD/terraform-validate@main
+
+      - name: Check Validation/Test Results
+        if: always()
+        run: |
+          # Set default values if outputs are empty
+          IS_VALID="${{ steps.validate.outputs.is_valid }}"
+          TESTS_PASSED="${{ steps.validate.outputs.tests_passed }}"
+
+          # If outputs are empty, set them to false
+          [ -z "$IS_VALID" ] && IS_VALID="false"
+          [ -z "$TESTS_PASSED" ] && TESTS_PASSED="false"
+
+          if [[ "$IS_VALID" != "true" || "$TESTS_PASSED" != "true" ]]; then
+            echo "Validation or test errors found:"
+            echo "${{ steps.validate.outputs.stderr }}"
+            exit 1
+          else
+            echo "All validations and tests passed successfully!"
+          fi

.pre-commit-config.yaml

@@ -47,7 +47,7 @@ repos:
 
 # Terraform Hooks
 - repo: https://github.com/antonbabenko/pre-commit-terraform
-  rev: v1.97.3 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
+  rev: v1.98.0 # Get the latest from: https://github.com/antonbabenko/pre-commit-terraform/releases
   hooks:
     - id: terraform_fmt
       args:
@@ -104,6 +104,6 @@ repos:
     #     - --hook-config=--parallelism-ci-cpu-cores=2
 
 - repo: https://github.com/ljnsn/cz-conventional-gitmoji
-  rev: v0.6.1
+  rev: v0.7.0
   hooks:
     - id: conventional-gitmoji

README.md

@@ -62,6 +62,7 @@ Common issues and solutions:
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
 | <a name="requirement_aws"></a> [aws](#requirement\_aws) | ~> 5.14 |
 | <a name="requirement_helm"></a> [helm](#requirement\_helm) | ~> 2.11 |
+| <a name="requirement_keycloak"></a> [keycloak](#requirement\_keycloak) | >= 5.0.0 |
 | <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | ~> 2.23 |
 | <a name="requirement_null"></a> [null](#requirement\_null) | ~> 3.2 |
 | <a name="requirement_random"></a> [random](#requirement\_random) | ~> 3.6 |
@@ -76,8 +77,8 @@ Common issues and solutions:
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_images"></a> [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
-| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git | main |
+| <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
+| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | main |
 
 ## Resources
 
@@ -92,22 +93,27 @@ Common issues and solutions:
 | <a name="input_cluster_domain"></a> [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
 | <a name="input_default_storage_class"></a> [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no |
-| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"bitnami_keycloak"` | no |
-| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"bn_keycloak"` | no |
+| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no |
+| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no |
 | <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no |
-| <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"bn_keycloak"` | no |
+| <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no |
 | <a name="input_namespace"></a> [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
 | <a name="input_postgresql_tag"></a> [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no |
-| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"keycloak-service"` | no |
+| <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no |
 | <a name="input_telemetry_namespace"></a> [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no |
 
 ## Outputs
 
 | Name | Description |
 |------|-------------|
+| <a name="output_admin_internal_endpoint"></a> [admin\_internal\_endpoint](#output\_admin\_internal\_endpoint) | internal endpoint for admin |
+| <a name="output_client_id"></a> [client\_id](#output\_client\_id) | The client ID for accessing keycloak. |
+| <a name="output_client_secret"></a> [client\_secret](#output\_client\_secret) | The client secret for accessing keycloak. |
+| <a name="output_discovery_url"></a> [discovery\_url](#output\_discovery\_url) | The URL for discovering keycloak services. |
 | <a name="output_module_name"></a> [module\_name](#output\_module\_name) | The name of this module. |
 | <a name="output_module_version"></a> [module\_version](#output\_module\_version) | The version of this module. |
 | <a name="output_namespace"></a> [namespace](#output\_namespace) | The namespace in which keycloak gets installed in. |
+| <a name="output_provider_config"></a> [provider\_config](#output\_provider\_config) | Add provider configuration block for easier consumption |
 | <a name="output_public_endpoint"></a> [public\_endpoint](#output\_public\_endpoint) | The endpoint at which keycloak can be reached from outside the cluster. |
 <!-- END_TF_DOCS -->

copy_images.tf

@@ -36,7 +36,7 @@ locals {
 }
 
 module "images" {
-  source = "git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade"
+  source = "git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/?ref=tf-upgrade"
 
   profile          = var.profile
   application_name = var.cluster_name

keycloak-values.yaml.tmpl

@@ -3,45 +3,64 @@ replicaCount: 3
 global:
   security:
     allowInsecureImages: true
-  imageRegistry: "${image_registry}"
-  defaultStorageClass: "${default_storage_class}"
+  imageRegistry: ${image_registry}
+  defaultStorageClass: ${default_storage_class}
 
 image:
-  registry: "${image_registry}"
-  repository: "${image_repository}"
-  tag: "${image_tag}"
+  registry: ${image_registry}
+  repository: ${image_repository}
+  tag: ${image_tag}
 
 autoscaling:
   enabled: true
   minReplicas: 1
   maxReplicas: 5
-  targetCPU: "80"
+  targetCPU: 80
 
 resources:
   requests:
     cpu: 100m
-    memory: 256Mi
+    memory: 512Mi
   limits:
     cpu: 2000m
-    memory: 2Gi
+    memory: 1024Mi
 
 metrics:
   enabled: true
   serviceMonitor:
     enabled: true
+  prometheusRule:
+    enabled: true
 
 service:
-  type: "ClusterIP"
+  type: ClusterIP
 
 production: true
-proxy: "edge"
+proxy: edge
+
+# Bootstrap configuration
+auth:
+  adminUser: ${keycloak_user}
+  adminPassword: ${keycloak_password}
+
+# Initial realm configuration
+initConfiguration:
+  createInitialAdmin: true
+  importRealms: false
+
+# Realms import configuration (optional)
+# initConfigurationFile: /configuration/realm-config.json
+# extraVolumes:
+#   - name: realm-config
+#     configMap:
+#       name: keycloak-realm-config
 
 postgresql:
   architecture: replication
   image:
     registry: ${image_registry}
-    repository: "${postgresql_image_repository}"
-    tag: "${postgresql_image_tag}"
+    repository: ${postgresql_image_repository}
+    tag: ${postgresql_image_tag}
   enabled: true
   auth:
     username: ${keycloak_user}
@@ -51,24 +70,45 @@ postgresql:
     resources:
       cpu: 100m
       memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 2Gi
   readReplicas:
     resources:
       cpu: 100m
       memory: 128Mi
+    limits:
+      cpu: 2000m
+      memory: 2Gi
 
 metrics:
   enabled: true
+tracing:
+  enabled: true
 
 extraEnv: |
   - name: JGROUPS_DISCOVERY_PROTOCOL
     value: dns.DNS_PING
   - name: JGROUPS_DISCOVERY_PROPERTIES
-    value: "dns_query=${serviceDnsName}"
+    value: 'dns_query={{ include "keycloak.serviceDnsName" . }}'
   - name: CACHE_OWNERS_COUNT
-    value: "3"
+    value: 3
   - name: CACHE_OWNERS_AUTH_SESSIONS_COUNT
-    value: "3"
+    value: 3
   - name: PROXY_ADDRESS_FORWARDING
-    value: "true"
+    value: true
   - name: KC_CONFIG_FILE
-    value: "/opt/bitnami/keycloak/kcadm.config"
+    value: /opt/bitnami/keycloak/kcadm.config
+  - name: KEYCLOAK_USER
+    value: ${keycloak_user}
+  - name: KEYCLOAK_PASSWORD
+    value: ${keycloak_password}
+  - name: KEYCLOAK_STATISTICS
+    value: all
+  - name: JAVA_OPTS
+    value: >-
+      -XX:+UseContainerSupport
+      -XX:MaxRAMPercentage=50.0
+      -Djava.net.preferIPv4Stack=true
+      -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS
+      -Djava.awt.headless=true