feat: add provisioner client configuration and secrets for API client management (ba441b0d) · Commits · OOP / deploy / helm

oop-platform-chart/charts/keycloak/templates/deployment.yaml

+5 −0

Changes for oop-platform-chart/charts/keycloak/templates/deployment.yaml: 5 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -96,6 +96,11 @@ spec:
		secretKeyRef:
		name: {{ $.Values.secretName }}
		key: oop-portal-admin-client-secret
		- name: OOP_PORTAL_PROVISIONER_CLIENT_SECRET
		valueFrom:
		secretKeyRef:
		name: {{ $.Values.secretName }}
		key: oop-portal-provisioner-client-secret
		{{- if .initialAdmin.enabled }}
		- name: INITIAL_ADMIN_PASSWORD
		valueFrom:

oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml

+46 −0

Changes for oop-platform-chart/charts/keycloak/templates/realms-configmap.yaml: 46 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -20,6 +20,7 @@ data:
		{{- with .Values.realms.oop }}
		{{- if .enabled }}
		{{- $portalUrl := include "keycloak.portalBaseUrl" $ }}
		{{- $apiProducts := include "keycloak.apiProducts" $ \| fromJsonArray }}
		oop.json: \|
		{
		"realm": "oop",
		@@ -29,6 +30,7 @@ data:
		{{- if $.Values.theme.enabled }}
		"loginTheme": "oop",
		{{- end }}
		"adminPermissionsEnabled": true,
		"registrationAllowed": true,
		"registrationEmailAsUsername": false,
		"loginWithEmailAllowed": true,
		@@ -64,6 +66,29 @@ data:
		"client": { "account": ["view-profile", "manage-account"] }
		}
		}
		],
		"client": {
		"oeg": [
		{{- range $i, $product := $apiProducts }}
		{{- if $i }},{{ end }}
		{ "name": {{ $product.name \| toJson }}, "description": {{ printf "API product %s (ADR-0048)" $product.name \| toJson }} }
		{{- end }}
		]
		}
		},
		{{- /*
		A CAMARA scope is issued only to a holder of its product's role on `oeg`: without the role
		the scope stays out of the token even though the client asks for it.
		*/ -}}
		"clientScopeMappings": {
		"oeg": [
		{{- $first := true }}
		{{- range $product := $apiProducts }}
		{{- range $scope := $product.scopes }}
		{{- if not $first }},{{ end }}{{ $first = false }}
		{ "clientScope": {{ $scope \| toJson }}, "roles": [ {{ $product.name \| toJson }} ] }
		{{- end }}
		{{- end }}
		]
		},
		"defaultRole": { "name": "default-roles-oop", "composite": true, "clientRole": false },
		@@ -154,6 +179,7 @@ data:
		]
		},
		{
		"id": {{ .oeg.internalId \| toJson }},
		"clientId": "oeg",
		"name": "Open Exposure Gateway",
		"description": "Resource server. Exists so the `oeg` audience names a real client; no login flows.",
		@@ -178,6 +204,20 @@ data:
		"implicitFlowEnabled": false,
		"directAccessGrantsEnabled": false,
		"serviceAccountsEnabled": true
		},
		{
		"clientId": {{ .provisioner.clientId \| toJson }},
		"name": "OOP Portal API client provisioning",
		"description": "Service account for creating API clients (ADR-0048); no login flows.",
		"enabled": true,
		"protocol": "openid-connect",
		"publicClient": false,
		"clientAuthenticatorType": "client-secret",
		"secret": "${OOP_PORTAL_PROVISIONER_CLIENT_SECRET}",
		"standardFlowEnabled": false,
		"implicitFlowEnabled": false,
		"directAccessGrantsEnabled": false,
		"serviceAccountsEnabled": true
		}
		],
		"users": [
		@@ -186,6 +226,12 @@ data:
		"enabled": true,
		"serviceAccountClientId": {{ .portalAdmin.clientId \| toJson }},
		"clientRoles": { "realm-management": ["manage-users", "view-users", "query-users", "view-realm"] }
		},
		{
		"username": {{ printf "service-account-%s" .provisioner.clientId \| toJson }},
		"enabled": true,
		"serviceAccountClientId": {{ .provisioner.clientId \| toJson }},
		"clientRoles": { "realm-management": ["create-client", "view-users", "query-users"] }
		}
		{{- if .initialAdmin.enabled }},
		{

oop-platform-chart/charts/keycloak/templates/secret.yaml

+1 −0

Changes for oop-platform-chart/charts/keycloak/templates/secret.yaml: 1 added line, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -20,6 +20,7 @@ data:
		{{- if .enabled }}
		oop-portal-client-secret: {{ include "keycloak.secretValue" (list .portal.clientSecret $existing "oop-portal-client-secret") }}
		oop-portal-admin-client-secret: {{ include "keycloak.secretValue" (list .portalAdmin.clientSecret $existing "oop-portal-admin-client-secret") }}
		oop-portal-provisioner-client-secret: {{ include "keycloak.secretValue" (list .provisioner.clientSecret $existing "oop-portal-provisioner-client-secret") }}
		{{- if .initialAdmin.enabled }}
		initial-admin-password: {{ include "keycloak.secretValue" (list .initialAdmin.password $existing "initial-admin-password") }}
		{{- end }}

oop-platform-chart/charts/keycloak/values.yaml

+13 −0

Changes for oop-platform-chart/charts/keycloak/values.yaml: 13 added lines, 0 removed lines.
Original line number	Diff line number	Diff line
		@@ -80,9 +80,22 @@ realms:
		# service account may read and change users in this realm (realm-management
		# manage-users, view-users, query-users, view-realm) and nothing else. Leave the secret
		# empty to generate it (credentials Secret: oop-portal-admin-client-secret).
		# The `oeg` client holds the API product roles (global.apiProducts). Its id is fixed so the
		# portal can be told it: its provisioner may not search for clients. Not a secret, only an
		# address; Keycloak accepts any string of up to 36 characters, not just a UUID.
		oeg:
		internalId: "oeg-client"
		portalAdmin:
		clientId: oop-portal-admin
		clientSecret: ""
		# Confidential client the portal backend uses to create API clients. Its service
		# account may register clients and look up users, nothing else: no view-clients, which would
		# expose every client's secret. The fine-grained permissions that let it grant the product
		# roles are applied by the realm job. Leave the secret empty to generate it (credentials
		# Secret: oop-portal-provisioner-client-secret).
		provisioner:
		clientId: oop-portal-provisioner
		clientSecret: ""
		# There is no mail server, so "Forgot password?" cannot send a reset email. These texts
		# replace Keycloak's "we will email you" wording on that page and after submitting it,
		# pointing users to an administrator instead. Once SMTP is configured, remove them with