[Major] Code Freeze PR

.github/workflows/terraform-release.yaml

@@ -1,13 +1,13 @@
-name: Terraform CI/CD
+name: Terraform Module Release
 on:
   workflow_dispatch:
   pull_request:
     types: [closed]
     branches:
       - main
 jobs:
-  terraform-ci-cd:
-    runs-on: 229685449397
+  terraform-release:
+    runs-on: "229685449397"
     permissions:
       contents: write
 

README.md

@@ -8,6 +8,11 @@ Terraform module for deploying and configuring Keycloak on EKS clusters.
 - Sets up default realms and clients
 - Manages pod security and networking policies
 
+Keycloak is a temporary OIDC solution to our clusters for enabling SSO login to the three web applications core to observability with the platform, ie. the Kubernetes Dashboard, Grafana and Kiali. Eventually, Keycloak will be replaced with OKTA provided OIDC, once TCO is ready for supporting this integration. Keycloak works in concert with GoGatekeeper that serves as an OIDC proxy fronting the web applications and validating the tokens originating from Keycloak. In our current configuration, we have a single generic user named `user` that acts as a master key for authenticating with Keycloak in the `cluster-user` realm, which is created by this module, and may access any of these applications. To retrieve the generic user password, run the following command: `kubectl get secret -n keycloak keycloak-user-creds -o jsonpath="{.data.password}" | base64 --decode ; echo`
+
+### Explanation of architecture
+![Explanation of architecture](./docs/keycloak-gatekeeper.png "Explanation of architecture")
+
 ## Prerequisites
 - Kubernetes cluster (EKS)
 - Helm v3+
@@ -71,37 +76,59 @@ Common issues and solutions:
 
 | Name | Version |
 |------|---------|
-| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.17.0 |
+| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.14 |
+| <a name="provider_aws.eecr"></a> [aws.eecr](#provider\_aws.eecr) | ~> 5.14 |
+| <a name="provider_helm"></a> [helm](#provider\_helm) | ~> 2.11 |
+| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | ~> 2.23 |
+| <a name="provider_null"></a> [null](#provider\_null) | ~> 3.2 |
+| <a name="provider_random"></a> [random](#provider\_random) | ~> 3.6 |
 
 ## Modules
 
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_images"></a> [images](#module\_images) | git::https://github.e.it.census.gov/terraform-modules/aws-ecr-copy-images.git/ | tf-upgrade |
-| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | main |
+| <a name="module_ingress_resources"></a> [ingress\_resources](#module\_ingress\_resources) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-istio-service-ingress.git | n/a |
+| <a name="module_keycloak_db_config"></a> [keycloak\_db\_config](#module\_keycloak\_db\_config) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
+| <a name="module_post_install"></a> [post\_install](#module\_post\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
+| <a name="module_pre_install"></a> [pre\_install](#module\_pre\_install) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//config-job | n/a |
+| <a name="module_service_account"></a> [service\_account](#module\_service\_account) | git::https://github.e.it.census.gov/SCT-Engineering/tfmod-config-job.git//service-account | n/a |
 
 ## Resources
 
 | Name | Type |
 |------|------|
 | [helm_release.keycloak](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [helm_release.keycloak-db](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
+| [kubernetes_namespace.keycloak](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
+| [null_resource.git_version](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
+| [random_uuid.user_secret](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
+| [aws_ecr_authorization_token.ecr_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
+| [aws_ecr_authorization_token.token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_authorization_token) | data source |
+| [kubernetes_secret.db-secrets](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/data-sources/secret) | data source |
 
 ## Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | aws account number | `string` | `""` | no |
+| <a name="input_admin_email"></a> [admin\_email](#input\_admin\_email) | The email address of the admin of the default realm. | `string` | `"email@example.com"` | no |
 | <a name="input_cluster_domain"></a> [cluster\_domain](#input\_cluster\_domain) | The domain name used to reference ingresses for the cluster. | `string` | n/a | yes |
 | <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | EKS cluster name name component used through out the EKS cluster describing its purpose (ex: dice-dev) | `string` | n/a | yes |
-| <a name="input_default_storage_class"></a> [default\_storage\_class](#input\_default\_storage\_class) | The default storage class to use for persistent volumes | `string` | `"gp3-encrypted"` | no |
-| <a name="input_keycloak_database"></a> [keycloak\_database](#input\_keycloak\_database) | The name of the database to create in the RDS instance. | `string` | `"keycloak"` | no |
-| <a name="input_keycloak_password"></a> [keycloak\_password](#input\_keycloak\_password) | The initial password for the database. | `string` | `"keycloak"` | no |
-| <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"22.0.1-debian-11-r30"` | no |
+| <a name="input_default_realm"></a> [default\_realm](#input\_default\_realm) | The default realm to use to configure the environment. | `string` | `"cluster-user"` | no |
+| <a name="input_eecr_info"></a> [eecr\_info](#input\_eecr\_info) | Enterprise ECR source information | <pre>object({<br/>    account_id = string<br/>    alias      = string<br/>    profile    = string<br/>    region     = string<br/>  })</pre> | <pre>{<br/>  "account_id": "269222635945",<br/>  "alias": "lab-gov-shared-nonprod",<br/>  "profile": "269222635945-lab-gov-shared-nonprod",<br/>  "region": "us-gov-east-1"<br/>}</pre> | no |
+| <a name="input_keycloak_chart_version"></a> [keycloak\_chart\_version](#input\_keycloak\_chart\_version) | The version of the helm chart to install | `string` | `"7.0.1"` | no |
+| <a name="input_keycloak_hostname"></a> [keycloak\_hostname](#input\_keycloak\_hostname) | The hostname used to access the keycloak service. | `string` | `"keycloak"` | no |
+| <a name="input_keycloak_namespace"></a> [keycloak\_namespace](#input\_keycloak\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
+| <a name="input_keycloak_tag"></a> [keycloak\_tag](#input\_keycloak\_tag) | The image tag associated with the keycloak\_chart\_version | `string` | `"26.0.7"` | no |
 | <a name="input_keycloak_user"></a> [keycloak\_user](#input\_keycloak\_user) | The username for the database. | `string` | `"keycloak"` | no |
-| <a name="input_namespace"></a> [namespace](#input\_namespace) | The namespace which will be created and into which keycloak will be deployed. | `string` | `"keycloak"` | no |
+| <a name="input_postgres_exporter_tag"></a> [postgres\_exporter\_tag](#input\_postgres\_exporter\_tag) | The tag of the postgres exporter image to use. | `string` | `"17.4.0"` | no |
+| <a name="input_postgresql_chart_version"></a> [postgresql\_chart\_version](#input\_postgresql\_chart\_version) | The helm chart version of postgresql to use. | `string` | `"17.4.0"` | no |
 | <a name="input_postgresql_tag"></a> [postgresql\_tag](#input\_postgresql\_tag) | The tag of the postgresql image to use. | `string` | `"17.4.0"` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS config profile used to upload images into ECR | `string` | `""` | no |
+| <a name="input_region"></a> [region](#input\_region) | AWS region | `string` | n/a | yes |
 | <a name="input_service_name"></a> [service\_name](#input\_service\_name) | The name of the service to be deployed in the EKS cluster. | `string` | `"service"` | no |
-| <a name="input_telemetry_namespace"></a> [telemetry\_namespace](#input\_telemetry\_namespace) | The namespace used for telemetry. | `string` | `"namespace"` | no |
+| <a name="input_utilities_tag"></a> [utilities\_tag](#input\_utilities\_tag) | Version tag for the docker image to use to execute kubectl commands. | `string` | `"1.0.3"` | no |
 
 ## Outputs
 
@@ -116,4 +143,6 @@ Common issues and solutions:
 | <a name="output_namespace"></a> [namespace](#output\_namespace) | The namespace in which keycloak gets installed in. |
 | <a name="output_provider_config"></a> [provider\_config](#output\_provider\_config) | Add provider configuration block for easier consumption |
 | <a name="output_public_endpoint"></a> [public\_endpoint](#output\_public\_endpoint) | The endpoint at which keycloak can be reached from outside the cluster. |
+| <a name="output_user_auth_realm"></a> [user\_auth\_realm](#output\_user\_auth\_realm) | The URL for discovering keycloak services. |
+| <a name="output_user_secret"></a> [user\_secret](#output\_user\_secret) | The name of the secret containing the sso user for accessing keycloak. |
 <!-- END_TF_DOCS -->