[incubator/keycloak] Add miscellaneous improvements #5372

unguiculus · 2018-05-03T10:53:43Z

Update Keycloak to 3.4.3.Final
Use nc to check for PostgreSQL availability in order to avoid
RBAC configurations
Allow additional volumes and mounts to be configured
Allow custom pre-start script to be configured
Improve affinity configuration
Add security context
Update _helpers.tpl
Only add environment variables for Keycloak credentials on
install. They are only needed for creating the intial user.
This avoids an error in the logs
Add pod disruption budget
Make test more robust
Update Postgresql dependency

unguiculus · 2018-05-03T10:54:10Z

* Update Keycloak to 3.4.3.Final * Use nc to check for PostgreSQL availability in order to avoid RBAC configurations * Allow additional volumes and mounts to be configured * Allow custom pre-start script to be configured * Improve affinity configuration * Add security context * Update _helpers.tpl * Only add environment variables for Keycloak credentials on install. They are only needed for creating the intial user. This avoids an error in the logs * Add pod disruption budget * Make test more robust

monotek · 2018-05-10T12:26:11Z

/assign lachie83

arroo · 2018-05-11T21:18:34Z

why get rid of RBAC? if KUBE_PING gets adopted won't that be needed?

unguiculus · 2018-05-14T06:34:58Z

@mozesmagyar The chart uses JDBC_PING which doesn't need RBAC.

unguiculus · 2018-05-14T06:36:52Z

@nexeck Please review.

arroo · 2018-05-14T21:51:03Z

incubator/keycloak/templates/configmap.yaml


-    exec /opt/jboss/docker-entrypoint.sh "${args[@]}"
+    exec /opt/jboss/docker-entrypoint.sh -b 0.0.0.0 {{- if $highAvailability }} --server-config standalone-ha.xml{{ end }}


possible to include additional args? for example, it would be nice to include importing realm settings for an install...

Let me think about it. I'd say this could go into a separate PR.

arroo · 2018-05-17T15:26:41Z

what's the likelihood of this getting merged before the 25th?

lachie83 · 2018-05-18T04:00:55Z

/lgtm

k8s-ci-robot · 2018-05-18T04:01:01Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lachie83, unguiculus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [lachie83,unguiculus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

masonhensley · 2018-05-18T13:47:19Z

Thanks for the improvements unguiculus! The change below with tls is more consistent with other helm charts my team uses.

For future searchers (see error at end of comment). helm upgrade -f custom-values.yml incubator/keycloak will break for you if you where previously on version 0.3 and didn't pin your version.

1

This update breaks custom tls values, you will need to upgrade your custom-values.yaml if you specify one. Easy 30 second fix, see the before and after of the values in the next link...

https://github.com/kubernetes/charts/pull/5372/files#diff-7b15cc8622ffbf734ff8d6a926c2fbd0L140

For instance, my values changed from:

tls:
  enabled: true
  existingSecret: "my-auth-tls-secret"
  secretContents: {}
  secretAnnotations: {}

To

tls:
  - hosts:
    - my.super-awesome-custom-url.com
    secretName: my-auth-tls-secret

2

Also, additionalEnv changed to extraEnv.
https://github.com/kubernetes/charts/pull/5372/files#diff-979e22b13dd707c03ff2d3b1e417c56cL147

3

The following also changes, see

hyperkube:
  image:

https://github.com/kubernetes/charts/pull/5372/files#diff-7b15cc8622ffbf734ff8d6a926c2fbd0L1

How to pin your helm chart

helm upgrade -f custom-values.yml incubator/keycloak --version=0.X.0

Helm upgrade error I encountered to hopefully help with SEO:

2018/05/18 12:00:00 warning: destination for tls is a table. Ignoring non-table value []
Error: UPGRADE FAILED: render error in "keycloak/templates/ingress.yaml": template: keycloak/templates/ingress.yaml:21:16: executing "keycloak/templates/ingress.yaml" at <.hosts>: can't evaluate field hosts in type interface {}

* [incubator/keycloak] Add miscellaneous improvements * Update Keycloak to 3.4.3.Final * Use nc to check for PostgreSQL availability in order to avoid RBAC configurations * Allow additional volumes and mounts to be configured * Allow custom pre-start script to be configured * Improve affinity configuration * Add security context * Update _helpers.tpl * Only add environment variables for Keycloak credentials on install. They are only needed for creating the intial user. This avoids an error in the logs * Add pod disruption budget * Make test more robust * Update Postgresql dependency * Align ingress configuration with best practices

* [incubator/keycloak] Add miscellaneous improvements * Update Keycloak to 3.4.3.Final * Use nc to check for PostgreSQL availability in order to avoid RBAC configurations * Allow additional volumes and mounts to be configured * Allow custom pre-start script to be configured * Improve affinity configuration * Add security context * Update _helpers.tpl * Only add environment variables for Keycloak credentials on install. They are only needed for creating the intial user. This avoids an error in the logs * Add pod disruption budget * Make test more robust * Update Postgresql dependency * Align ingress configuration with best practices Signed-off-by: voron <av@arilot.com>

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels May 3, 2018

unguiculus force-pushed the feature/keycloak branch 4 times, most recently from 0c224fa to 231f923 Compare May 3, 2018 12:51

unguiculus force-pushed the feature/keycloak branch from 231f923 to 453fdb9 Compare May 3, 2018 14:35

This was referenced May 3, 2018

[incubator/keycloak] Provide a way to override the keycloak.sh file #5222

Closed

Keycloak requires additional permissions for installation #4899

Closed

Adding custom keycloak theme for chart #4633

Closed

k8s-ci-robot assigned lachie83 May 10, 2018

unguiculus added 2 commits May 14, 2018 09:13

Update Postgresql dependency

5bcf267

Align ingress configuration with best practices

d44f538

arroo reviewed May 14, 2018

View reviewed changes

k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label May 18, 2018

k8s-ci-robot merged commit 8759f58 into helm:master May 18, 2018

briantopping mentioned this pull request May 28, 2018

[incubator/keycloak] Provide means to provide certificates for truststore.jks #5786

Closed

unguiculus deleted the feature/keycloak branch June 4, 2018 06:49

mattfarina unassigned lachie83 Jul 19, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[incubator/keycloak] Add miscellaneous improvements #5372

[incubator/keycloak] Add miscellaneous improvements #5372

unguiculus commented May 3, 2018 •

edited

Loading

unguiculus commented May 3, 2018

monotek commented May 10, 2018

arroo commented May 11, 2018

unguiculus commented May 14, 2018

unguiculus commented May 14, 2018

arroo May 14, 2018 •

edited

Loading

unguiculus May 15, 2018

arroo commented May 17, 2018

lachie83 commented May 18, 2018

k8s-ci-robot commented May 18, 2018

masonhensley commented May 18, 2018 •

edited

Loading


		exec /opt/jboss/docker-entrypoint.sh "${args[@]}"
		exec /opt/jboss/docker-entrypoint.sh -b 0.0.0.0 {{- if $highAvailability }} --server-config standalone-ha.xml{{ end }}

[incubator/keycloak] Add miscellaneous improvements #5372

[incubator/keycloak] Add miscellaneous improvements #5372

Conversation

unguiculus commented May 3, 2018 • edited Loading

unguiculus commented May 3, 2018

monotek commented May 10, 2018

arroo commented May 11, 2018

unguiculus commented May 14, 2018

unguiculus commented May 14, 2018

arroo May 14, 2018 • edited Loading

Choose a reason for hiding this comment

unguiculus May 15, 2018

Choose a reason for hiding this comment

arroo commented May 17, 2018

lachie83 commented May 18, 2018

k8s-ci-robot commented May 18, 2018

masonhensley commented May 18, 2018 • edited Loading

1

2

3

How to pin your helm chart

Helm upgrade error I encountered to hopefully help with SEO:

unguiculus commented May 3, 2018 •

edited

Loading

arroo May 14, 2018 •

edited

Loading

masonhensley commented May 18, 2018 •

edited

Loading