Feature gatekeeper

.github/workflows/terraform-ci.yml

@@ -0,0 +1,104 @@
+name: 'Terraform Module CI'
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**/*.tf'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '**/*.tf'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  validate:
+    name: 'Validate Module'
+    runs-on: self-hosted
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v2
+      with:
+        terraform_version: 1.5.0
+
+    - name: Terraform Init
+      run: |
+        terraform init -backend=false
+
+    - name: Terraform Format
+      run: |
+        terraform fmt -check
+
+    - name: Terraform Validate
+      run: |
+        terraform validate
+
+    - name: Run tflint
+      uses: terraform-linters/setup-tflint@v3
+      if: github.event_name == 'pull_request'
+
+    - name: Lint Terraform
+      if: github.event_name == 'pull_request'
+      run: |
+        tflint --format compact
+
+    - name: Run Checkov
+      uses: bridgecrewio/checkov-action@master
+      with:
+        directory: .
+        framework: terraform
+        skip_check: CKV_AWS_115,CKV_AWS_116
+        quiet: true
+        soft_fail: true
+        output_format: sarif
+        output_file: checkov-results.sarif
+
+  release:
+    name: 'Create Release'
+    needs: validate
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: self-hosted
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.9'
+
+      - name: Install Commitizen
+        run: |
+          pip install commitizen
+
+      - name: Bump Version and Generate Changelog
+        id: cz
+        run: |
+          cz bump --yes
+          echo "new_version=$(cz version --project)" >> $GITHUB_OUTPUT
+          echo "changelog=$(cz changelog --dry-run)" >> $GITHUB_OUTPUT
+
+      - name: Create Release
+        uses: actions/create-release@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: v${{ steps.cz.outputs.new_version }}
+          release_name: Release v${{ steps.cz.outputs.new_version }}
+          draft: false
+          prerelease: false
+          body: ${{ steps.cz.outputs.changelog }}

README.md

@@ -8,6 +8,11 @@ Terraform module for deploying and configuring Keycloak on EKS clusters.
 - Sets up default realms and clients
 - Manages pod security and networking policies
 
+Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo`
+
+### Explanation of architecture
+![Explanation of architecture](./keycloak-gatekeeper.png "Explanation of architecture")
+
 ## Prerequisites
 - Kubernetes cluster (EKS)
 - Helm v3+
@@ -77,8 +82,8 @@ Common issues and solutions:
 
 | Name | Source | Version |
 |------|--------|---------|
-| <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
-| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | main |
+| <a name="module_images"></a> [images](#module\_images) | git@github.e.it.census.gov:terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
+| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git@github.e.it.census.gov:SCT-Engineering/tfmod-istio-service-ingress.git | main |
 
 ## Resources